last executing test programs: 56.442870248s ago: executing program 0 (id=1): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1800403, &(0x7f0000000080)={[{@noload}]}, 0x0, 0x5e5, &(0x7f00000000c0)="$eJzs3c1vVFUbAPDn3k4Lpe/7ti8xKi5MoyGQKC0tYPBjAXtC8GPnxkoLQcpHaI0WTSwJbkyMGxckrlyI/4US3boyunDhxpUhQWNIDMboNXd6ZxjamXZaZnqx8/slw9xzzsycc0ufnnPPPXduAD1rNP8njdgVEReTiOGGskoUhaNLr7v927sn80cSWfbyr0kkRV7t9UnxPFS8+a/hiG+/SmJn38p65xYun52anZ25VKTH589dHJ9buLzvzLmp0zOnZ85PPjN5+NDBQ4cn9t/X/qUN28euvvHW8AfHX/3skz+Tic9/PJ7Ekfjl1FJZ4350ymiMxp0se295fv5zPdzpykrSV/89uStZnsEDq1LESH9EPBLD0dfwvzkc779YauOArsqSiAzoUYn4hx5VGwfUju3bOw5OuzwqATbDraNRPfpfGf+VpbnBGKnODexe9r4mU3obktfxzdfHr+aPaDkPt71DtQGNFq9sK7aWx39Sjc2RIvZ23E7vmefNRwAniuc8/6UN1j+6LN2NeXigucUrEfFos/H/2vH/WkP8v77B+sU/AAAAAAAAdM6NoxHxdLPzf2lxbm57PFE9/5csnf/7/u4Vgkc6UP/a5//Smx2oBmji1tGIF5qu/62v8R3pK1L/XVoNmJw6MzuzPyL+FxF7o39bnp5YpY59H+681qqscf1f/sjrr60FLNpxs7Lt3vdMT81P3c8+A0tuXYl4rNJ6/U/e/yeN/X8h/3twsc06du6+fqJV2drxD3RL9mnEnqb9f1J/TbL693OMV8cD47VRwUqPv/PRF63qF/9Qnrz/37F6/I8kjd/XM7e+zx+IiAMLlaxV+UbH/wPJK321z8+9PTU/f2kiYiA5tjJ/cn1thq2qFg+1eMnjf++Tq8//1cf/DXE4GBGLbdb58N9DP7UqG43Iio/V/8Mmy+N/ukn/P9iy/1//xuT1kS9b1d9e/3+w2qfvLXLM/8Hq2g3QstsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9GaUT8J5J0rL6dpmNjEUMR8VDsSGcvzM0/derCm+en87Lq/f/T2p1+h5fSSe3+/yMN6cll6QMR8f+I+LhvsJoeO3lhdrrsnQcAAAAAAAAAAAAAAAAAAIAHxFCL6/9zP/eV3Tqg6yrFs3iH3lMpuwFAacQ/9C7xD71L/EPvaiP+72xGO4DNt8H+3+kC2AKM/6FX9bf3su3dbgdQBv0/AAAAAABsKTeef/ZaEhGLzw1WH7mBoqx+YnCwrNYB3ZSW3QCgNNbwQu+y9Ad6V5uLf4EtLKlv/ZE1K2+9+j/pToMAAAAAAAAAAAAAgBX27Lrxw5rX/wNbUhpxpOw2AOVw/T/0Ltf/Q+9qcYzvmAB6yFpX8W/o+n+3DAQAAAAAAAAAAACAjppbuHx2qnYT8KnZ2ZlL1RwbW3Tju9+zbF3vyrLyfjf6I6L0n1gpGwON4bkZlUbE4oocAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADggfBPAAAA//9wQh8o") prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f00000006c0)='.\x00', 0x9900, &(0x7f0000000700)={0x4, 0xf5, 0x80000}, 0x20) 56.203662644s ago: executing program 0 (id=8): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x40, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000f80)='./file1\x00', 0x183042, 0x25) r1 = open(&(0x7f0000001500)='./file1\x00', 0x4827e, 0xdc) fallocate(r1, 0x0, 0x0, 0x8800000) fallocate(r0, 0x20, 0x4000, 0x8000) 55.596112779s ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/unprivileged_bpf_disabled\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0', 0x1) write$binfmt_elf32(r0, &(0x7f00000002c0)={{0x7f, 0x45, 0x4c, 0x46, 0xa9, 0x3, 0xd, 0x10, 0x1, 0x3, 0x0, 0x8, 0x241, 0x38, 0x2fa, 0x4, 0x8, 0x20, 0x1, 0x3, 0xfff8, 0x2ee}, [{0x5, 0x71b1, 0x5, 0x100, 0x1d6, 0x6, 0xe, 0x5}]}, 0x58) 54.72220758s ago: executing program 32 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/unprivileged_bpf_disabled\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0', 0x1) write$binfmt_elf32(r0, &(0x7f00000002c0)={{0x7f, 0x45, 0x4c, 0x46, 0xa9, 0x3, 0xd, 0x10, 0x1, 0x3, 0x0, 0x8, 0x241, 0x38, 0x2fa, 0x4, 0x8, 0x20, 0x1, 0x3, 0xfff8, 0x2ee}, [{0x5, 0x71b1, 0x5, 0x100, 0x1d6, 0x6, 0xe, 0x5}]}, 0x58) 37.393090665s ago: executing program 5 (id=207): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100)={0x2, {0x2, 0x103, 0x100, 0x751}}) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x105, 0xffff, 0x300, 0x3}}) 37.354225366s ago: executing program 5 (id=210): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) readv(r0, &(0x7f0000001a40)=[{&(0x7f0000001a80)=""/217, 0xd9}], 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 37.287714148s ago: executing program 5 (id=211): r0 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000080), 0x4) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x0, 0x1, r1}, 0xc) setsockopt$inet6_buf(r0, 0x29, 0xcc, &(0x7f0000000180), 0x0) syz_emit_ethernet(0x46, &(0x7f0000000240)=ANY=[@ANYBLOB="33330000123400112233445586dd6000000000103b40fe8000000000000000000000000000bbff0e0000000000000000000000001234"], 0x0) 37.258857658s ago: executing program 5 (id=212): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x20000a, &(0x7f00000002c0)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYRESDEC=r0], 0x1, 0x39a, &(0x7f0000000300)="$eJzs3T1vW+UXAPBTt4mT/P+JMyAkQIhH3VisJHyBRqiVEJFAoUalA+KWOMWKG0e2FeQKQQckVr4Be8XIhoT4AhlgZ2PLwtihqpHfUjt130iTS8XvJ1n3+D7n2M+15auzWOfw2ve3drZb5e2sHYVLKQoRUbgXsdyPBs4Nj4V+PBvj7sTbpWt/vPnRJ9ffX9/YuLyZ0pX1q++spZSW3vrly69+vPhr+38f/7T0czEOlj89/Gvtz4NXD147fHD1i1or1Vppt9FOWbrRaLSzG/Vq2qq1dsopfVivZq1qqu22qs2J9e16Y2+vk7LdrcWFvWa11UrZbiftVDup3UjtZidlN7PabiqXy2lxIXiayt3NzWx9EM89Ie/SWW2IU9Bsrme933DxkZXK3Vw2BADk6qT9/+wz9f/XC2P9/1w8rv8vRuj/X4iZZ0sb7///8YvwL9fr/2eHv99J+n8AAAAAAAAAAAAAAHgZ3Ot2S91utzQ6dkd/Eh4+z3l7nLJHvv9jj7z3x+ka++PeXET9u/3KfmVwHKyvb0ct6lGNlSjF/d5tYWQQX3lv4/JK6luOxVvf9Osv/hZROT9ZvxqlWJ5evzqoT0f10TvOxMJ4/Vp8Fq9Mr1+bWj8bKz+M1ZejFL9/Ho2ox1b/9vaw/uvVlN79YONYfbGfBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB/QzmNvBGDuff7lYj52B/O7y8/TFienI8/qD+ar78Spbg/fT7/ytT5/Bfi9Qv5XjsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjLQ6t3eyer3aPKtgNPO/f2Z2FDy+6twg/c6xpfmYTC4+7XVOGBSeq2p+eJFTlh50u91+cPPbF7Gx3rscnZk726/yJMFMRDwhpzv8AE/+Xv+PiPEz5ydzihFxqle61AsK+X/gzx3kcDMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAnB0N/e49OZf3bgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMhLq3N7J6vXq81TDPK+RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJfJ3wEAAP//2L8JSw==") r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000cc0), 0x4) inotify_init1(0x80800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$XFS_IOC_FSINUMBERS(r1, 0xc0205867, &(0x7f0000000ac0)={0x0, 0x2, 0x0, 0x0}) mkdir(&(0x7f0000000000)='./sys_mount\x00', 0x0) mount(0x0, &(0x7f0000000040)='./sys_mount\x00', &(0x7f0000000080)='sysfs\x00', 0x10000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mount/block/loop0/queue/scheduler\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='bfq', 0x3) getrandom(&(0x7f0000000d00)=""/286, 0x11e, 0x100000000000001) 36.395338849s ago: executing program 5 (id=217): r0 = io_uring_setup(0xa86, &(0x7f0000000300)={0x0, 0xf12b, 0x10000, 0x40000, 0x800003d7}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x8) connect$inet(r2, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x6, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r4}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x3c}, @generic={0x95}], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@map=r4, r5, 0x7, 0x0, 0x0, @void, @value=0x0}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r4, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r3}, 0x20) socket(0x10, 0x803, 0x0) socket$packet(0x11, 0x3, 0x300) sendto(r3, &(0x7f0000000700)='ab', 0xfffffcf4, 0x11, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 36.123837576s ago: executing program 5 (id=220): r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x7ffffffe, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) 36.080034467s ago: executing program 33 (id=220): r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x7ffffffe, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) 9.230302034s ago: executing program 4 (id=387): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xa, "0062ba7d82000000160000000000f738096304"}) r1 = syz_open_pts(r0, 0x900) r2 = dup3(r1, r0, 0x80000) read(r2, &(0x7f0000000340)=""/226, 0xe2) 8.917134572s ago: executing program 6 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000340)='10', 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x121001, 0x0) 7.096954806s ago: executing program 4 (id=393): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r0, &(0x7f00000008c0)='1.2', 0x3) 7.073550577s ago: executing program 4 (id=394): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r0, &(0x7f0000000040)=ANY=[], 0x200002e6) fcntl$setpipe(r0, 0x407, 0x7000000) 6.830811573s ago: executing program 6 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000340)='10', 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x121001, 0x0) 5.087794776s ago: executing program 4 (id=403): syz_mount_image$ext4(&(0x7f0000000c40)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x3000000, &(0x7f0000000cc0)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x4, 0x530, &(0x7f0000000d00)="$eJzs3WFrI2kdAPD/TJu9dLdncyqyHugd3snuoZtsr56uIncriL5aUM/3a22zpWzaLE16bsuhPfwAgogKfgDfCCK+FOQ+gYhwoO9FRRHd05e6I5NMz6ZJ2timzZn+fvA0zzPP5Pk/z9BMMjMPMwFcWM9GxO2ImImIFyJioVieFin2uilf7+1Hr6/kKYkse/VvSSTFsv228vJsRFwp3laOiK98MeLrSX/c1s7u/eVGo75VlGvtjQe11s7ujfWN5bX6Wn1zaWnx5xHx0q2bWeFU46xExMuf/9P3v/PjL7z8y49/4/d3/3L9m3m3PvuBbr8j4p1xxJ1TherRbbvU2Rb78m20Nb4QE5ePpzQz6V4AADCK/Df+eyPiI53f/wsx0/k1BwAAAEyT7JX5+FcSkQEAAABTK42I+UjSajEXYD7StFrtzuF9f1xOG81W+2P3mtubq3ldRCVK6b31Rv1mMVe4EqUkLy8Wc2z3yy8eKi9FxFMR8b2FuU65utJsrE765AcAAABcEFee6T3+/+dC2skDAAAAU6YytAAAAABMC4f8AAAAMP0c/wMAAMBU+9KdO3nK9p/jvfrazvb95ms3Vuut+9WN7ZXqSnPrQXWt2Vzr3LNv47j2Gs3mg0/E5vbDWrveatdaO7t3N5rbm+276z2PwAYAAADO0VPPvPm7JCL2PjPXSVHcBxCgxx8n3QFgnGYm3QFgYmYn3QFgYkrHrmEPAdMuOaa+f/JO91xh/Pps+gMAAIzftQ/2X/+/VNQdf24A+H9mrg8AXDy9V/fmJtYP4PyVTjoD8Oq4ewJMynu6L08Mqx96844Rrv93zzFk2Yk6BgAAjM18JyVptTgGmI80rVYjnozHWSVKyb31Rv1mUffbhdITeXmx887k2DnDAAAAAAAAAAAAAAAAAAAAAAAAAEBXliWRAQAAAFMtIv1z0rmbf8S1hefne88OHHrq149e/cHD5XZ7azHiUvL3hXzRpYho/7BY/mLmkQAAAAAwWXP5n+5xevG6OOkuAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBt3n70+sp+Os+4f/1cRFQGxZ+Ncue1HKWIuPyPJGYPvC+JiJkxxN97IyKuDoqfxOMsyyrxq6yrP/7cGcevdDZNdyscHn8aEVfGEB8usjfz/c/tQZ+/NJ7tvA7+/M0W6bSG7//Sd/Z/M0P2f08eKg/z9Fs/rQ2N/0bE07OD9z/78ZNu/J4QeeG5Ecf4ta/u7g6sONDkoPgHY9XaGw9qrZ3dG+sby2v1tfrm0tLiJ2996tZLt27W7q036sXfgWG++6FfPD5q/JeHxK/0jr9v+z8/0uiz+PdbDx+9r1soDYp//bnB379Xh8RPi+++jxb5vP7afn6vmz/owz/5Tfmo8a8OGX/5mPFfH2n88ekXvvztPwys6dsaAMB5aO3s3l9uNOpbR2TKI6zzP2UiTtvOK2Ptz7shE8evU36XdPUsMtm3uv+Pp2vnlG/vy2QjrXx7cNVsjKEbl/o+pzNx0gaTiL28rRH/IQEAgCnz3x/9R11BAgAAAAAAAAAAAAAAAAAAAM7SCW9LVo6IA0t+dmQ7h2PuTWaoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH+k8AAAD//+1J2Lw=") socket$can_bcm(0x1d, 0x2, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./tracing\x00', &(0x7f0000000740)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) 5.021352407s ago: executing program 3 (id=405): syz_open_dev$ptys(0xc, 0x3, 0x1) r0 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) syz_clone3(&(0x7f0000000000)={0x180801400, &(0x7f0000000240)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) waitid$P_PIDFD(0x3, r4, 0x0, 0x40000004, 0x0) 3.990309592s ago: executing program 3 (id=408): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000002c0)=ANY=[], 0xff2e) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000300)=0x889d) 3.867711085s ago: executing program 4 (id=409): r0 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x11, 0x80001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r1, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000280)=0xffffffff) 3.867489145s ago: executing program 6 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000340)='10', 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x121001, 0x0) 3.390535597s ago: executing program 4 (id=413): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x17, 0x0, 0x9, 0x6, 0x0, 0x70bd25, 0x25dfdbff, [@sadb_lifetime={0x4, 0x4, 0x3, 0x7, 0x7, 0x7c}]}, 0x30}}, 0x4000000) 3.390384327s ago: executing program 34 (id=413): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x17, 0x0, 0x9, 0x6, 0x0, 0x70bd25, 0x25dfdbff, [@sadb_lifetime={0x4, 0x4, 0x3, 0x7, 0x7, 0x7c}]}, 0x30}}, 0x4000000) 3.308747459s ago: executing program 1 (id=414): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x8010}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x100, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000700)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000880)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000000b40)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.308527849s ago: executing program 2 (id=415): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20020800}, 0x0) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x28, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004040}, 0x40) 3.27924393s ago: executing program 2 (id=416): mkdir(&(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='r', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/serio/devices/serio1/drvctl\x00', 0x1, 0x0) openat(r0, 0x0, 0x60540, 0x100) write(r1, &(0x7f0000000300)='r', 0x1) 3.220129751s ago: executing program 7 (id=419): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) 3.156951843s ago: executing program 6 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000340)='10', 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x121001, 0x0) 3.025235766s ago: executing program 1 (id=417): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000fbdbdf250100000000000000094100000002001800"], 0x68}, 0x1, 0x0, 0x0, 0x44}, 0x240400c0) 3.024864746s ago: executing program 3 (id=418): syz_open_dev$ptys(0xc, 0x3, 0x1) r0 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) syz_clone3(&(0x7f0000000000)={0x180801400, &(0x7f0000000240)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) waitid$P_PIDFD(0x3, r4, 0x0, 0x40000004, 0x0) 3.024728686s ago: executing program 2 (id=420): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x800000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='off\n', 0x4) write$tcp_congestion(r0, &(0x7f0000000180)='vegas\x00', 0x6) 3.024659246s ago: executing program 7 (id=419): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) 2.923450568s ago: executing program 1 (id=421): r0 = open(&(0x7f0000000040)='./bus\x00', 0x1c1242, 0x0) ftruncate(r0, 0x2007ffb) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080), 0x103902, 0x0) sendfile(r1, r0, &(0x7f0000000280)=0x6, 0x5) 2.919496489s ago: executing program 2 (id=422): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000c40), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000c80)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000cc0)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000d00)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000e80)=@newtfilter={0x80, 0x2c, 0x401, 0x3ffe, 0x0, {0x0, 0x0, 0x0, r2, {0xe}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x50, 0x2, [@TCA_BASIC_ACT={0x4c, 0x3, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x20, 0x7}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x80}}, 0x0) write(r0, &(0x7f0000000f00)="ffffffffffffc011223344554305", 0xe) 2.820726391s ago: executing program 1 (id=423): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000480)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000500)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000580), 0x318, 0x0) recvmmsg(r1, &(0x7f00000005c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000600)=0x2) listen(0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000640)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000680), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./config\x00', &(0x7f0000000740)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000840)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') write(0xffffffffffffffff, 0x0, 0x0) 2.809104492s ago: executing program 6 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000340)='10', 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x121001, 0x0) 2.808260462s ago: executing program 7 (id=419): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) 573.300996ms ago: executing program 1 (id=424): syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000300)='./file1\x00', 0x844, &(0x7f0000000340)=ANY=[], 0x1, 0x267, &(0x7f0000000540)="$eJzs3b9rVFkUAOAzmcmvbSYsCwvLLjuwLGw1JIHtsyy7bNigYhgkIsGJmUjIhICBgBZJrAQrG0vLdBFBCzv9HwQbG7ERS9NZSJ4kL0xmzEQTMfMk833NPbx7znv33vDeyxRz5/LPiwuzS8tzW1uvY2AgF4Wxq9tJkouh6Il8pNYDADhN3iVJvE1SWY8FAOgM738A6D6Hvf//60nb3rQ5l8XYAICT8eWf/+9OPXlZrY39eYTUpL8Rvpg+/hgBgK9rcuri/9tPfx8cj0d3IhZvrVRWKmmb9v81F/NRj1oMRzHeRyQNafzv+MQ/w6UdgxGVxbW9+rWVSr61fiSKMRRx4czB+pFSqrW+N75rrh+NYvzQ/vqjbev74o/fmurLUYxnV2Ip6jG78y9JU/3qSKn099mJj+r7d/NiI5/p3wcAAAAAAAAAAAAAAAAAAAAAgNOpXGoYard/T7l8WH9af/T9gfb357m9W1+InwpxM9vZAwAAAAAAAAAAAAAAAAAAwLdh+fqNhWq9XrvWCGbOz3/feuRzQa5NV37v/Mc5T9cEOwtzgpf4NSJOehYPN2vPN6YvTWa/mB0M2q/qg8wHNvOJnJ6I2A1+vDdWfbz66s3BnFhvupcL6X1bradtX/PDotThhxMAAAAAAAAAAAAAAAAAAHSZ/a8BH5aRdHZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCB/d//P3bQ1ziyOZierNH1y0Bzctp5v+W6ufUMJgsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQNf6EAAA//9rIKjm") mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./tracing\x00', 0x1ff) 573.074286ms ago: executing program 2 (id=425): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="23000000d584000002000000ffff000005"], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0xfffffffc, r0}, 0x38) 572.155496ms ago: executing program 3 (id=426): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x8001000000000000, 0x40, &(0x7f00000016c0)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0x0, 0x11, 0x148, 0xd0, 0x0, 0x1b0, 0x2a8, 0x2a8, 0x1b0, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2b}, 0xffffff00, 0xffffffff, 'pim6reg\x00', 'veth0_vlan\x00', {0xff}, {}, 0x5e, 0x3, 0x2}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x6, 0x5, 0x5, 0x6, 0x20], 0x7, 0x1}, {0xffffffffffffffff, [0x56, 0x4, 0x8, 0x5e, 0x1], 0x0, 0x4}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xfffa, 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x2, 0x9, 0x8, 'syz0\x00', {0x7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a8) 532.725507ms ago: executing program 3 (id=427): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r1, &(0x7f00000011c0)=""/102392, 0x18ff8) write(r0, &(0x7f0000000000)='2', 0x1) syz_ublk_setup_io_uring(0x7042, 0x0, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) openat$nsim_dev_bool(0xffffffffffffff9c, 0x0, 0x121800, 0x0) 472.608569ms ago: executing program 2 (id=428): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1800403, &(0x7f0000000080)={[{@noload}]}, 0x0, 0x5e5, &(0x7f00000000c0)="$eJzs3c1vVFUbAPDn3k4Lpe/7ti8xKi5MoyGQKC0tYPBjAXtC8GPnxkoLQcpHaI0WTSwJbkyMGxckrlyI/4US3boyunDhxpUhQWNIDMboNXd6ZxjamXZaZnqx8/slw9xzzsycc0ufnnPPPXduAD1rNP8njdgVEReTiOGGskoUhaNLr7v927sn80cSWfbyr0kkRV7t9UnxPFS8+a/hiG+/SmJn38p65xYun52anZ25VKTH589dHJ9buLzvzLmp0zOnZ85PPjN5+NDBQ4cn9t/X/qUN28euvvHW8AfHX/3skz+Tic9/PJ7Ekfjl1FJZ4350ymiMxp0se295fv5zPdzpykrSV/89uStZnsEDq1LESH9EPBLD0dfwvzkc779YauOArsqSiAzoUYn4hx5VGwfUju3bOw5OuzwqATbDraNRPfpfGf+VpbnBGKnODexe9r4mU3obktfxzdfHr+aPaDkPt71DtQGNFq9sK7aWx39Sjc2RIvZ23E7vmefNRwAniuc8/6UN1j+6LN2NeXigucUrEfFos/H/2vH/WkP8v77B+sU/AAAAAAAAdM6NoxHxdLPzf2lxbm57PFE9/5csnf/7/u4Vgkc6UP/a5//Smx2oBmji1tGIF5qu/62v8R3pK1L/XVoNmJw6MzuzPyL+FxF7o39bnp5YpY59H+681qqscf1f/sjrr60FLNpxs7Lt3vdMT81P3c8+A0tuXYl4rNJ6/U/e/yeN/X8h/3twsc06du6+fqJV2drxD3RL9mnEnqb9f1J/TbL693OMV8cD47VRwUqPv/PRF63qF/9Qnrz/37F6/I8kjd/XM7e+zx+IiAMLlaxV+UbH/wPJK321z8+9PTU/f2kiYiA5tjJ/cn1thq2qFg+1eMnjf++Tq8//1cf/DXE4GBGLbdb58N9DP7UqG43Iio/V/8Mmy+N/ukn/P9iy/1//xuT1kS9b1d9e/3+w2qfvLXLM/8Hq2g3QstsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9GaUT8J5J0rL6dpmNjEUMR8VDsSGcvzM0/derCm+en87Lq/f/T2p1+h5fSSe3+/yMN6cll6QMR8f+I+LhvsJoeO3lhdrrsnQcAAAAAAAAAAAAAAAAAAIAHxFCL6/9zP/eV3Tqg6yrFs3iH3lMpuwFAacQ/9C7xD71L/EPvaiP+72xGO4DNt8H+3+kC2AKM/6FX9bf3su3dbgdQBv0/AAAAAABsKTeef/ZaEhGLzw1WH7mBoqx+YnCwrNYB3ZSW3QCgNNbwQu+y9Ad6V5uLf4EtLKlv/ZE1K2+9+j/pToMAAAAAAAAAAAAAgBX27Lrxw5rX/wNbUhpxpOw2AOVw/T/0Ltf/Q+9qcYzvmAB6yFpX8W/o+n+3DAQAAAAAAAAAAACAjppbuHx2qnYT8KnZ2ZlL1RwbW3Tju9+zbF3vyrLyfjf6I6L0n1gpGwON4bkZlUbE4oocAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADggfBPAAAA//9wQh8o") prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000840)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./sys\x00', &(0x7f0000000ac0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000e40)='./file0\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000ec0)='./file0\x00', 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0) write(r0, &(0x7f0000000dc0)='1', 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000880)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000008c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000940)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000009c0), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000a00), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000a40)=0x2) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000"], 0x50) socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b00)={0x1b, 0x0, 0x0, 0x40000, 0x0, r4, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x15, 0x1c, &(0x7f0000000c40)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xbda}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = syz_create_resource$futex(&(0x7f00000007c0)=0x1) futex(r6, 0x9, 0x1, 0x0, 0x0, 0x1) futex(r6, 0x5, 0x80000008, 0x0, r6, 0x4000000) r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0, 0x0) getdents64(r7, &(0x7f0000000700)=""/174, 0xff56) 127.829167ms ago: executing program 1 (id=429): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB="620ad0ff45002c00620ad4ff00000000620ad8ff40060000620adcff7f000001620ae0ff7f000001620ae4ff12345678620ae8ff15223344620aecff00000000620af0ff60021000620af4ff00000000620af8ff1c0405b4620afcff00000000bfa100000000000007010000d0ffffffbfa200000000000007020000e4ffffffb70300001800000085000000cc000000b70000000200000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0x22, 0x0, &(0x7f00000004c0)="00000000000100000000000208004500002800000000400600007f0000017f000001", 0x0, 0x4d08d857, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 109.819168ms ago: executing program 7 (id=419): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) 98.853518ms ago: executing program 3 (id=430): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xb}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x54}, 0x1, 0x0, 0x0, 0x40080a5}, 0x20008040) 0s ago: executing program 6 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000340)='10', 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x121001, 0x0) kernel console output (not intermixed with test programs): 68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.230200][ T28] audit: type=1400 audit(1792039311.699:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 26.283367][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.292180][ T28] audit: type=1400 audit(1792039311.809:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 26.317780][ T28] audit: type=1400 audit(1792039311.809:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.350195][ T28] audit: type=1400 audit(1792039311.869:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.351464][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.375841][ T28] audit: type=1400 audit(1792039311.869:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.032419][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.039692][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.047285][ T287] device bridge_slave_0 entered promiscuous mode [ 28.056214][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.063381][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.070841][ T287] device bridge_slave_1 entered promiscuous mode [ 28.133823][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.140905][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.148522][ T289] device bridge_slave_0 entered promiscuous mode [ 28.158733][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.165962][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.173509][ T289] device bridge_slave_1 entered promiscuous mode [ 28.214868][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.221947][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.229546][ T288] device bridge_slave_0 entered promiscuous mode [ 28.240500][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.247711][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.255288][ T288] device bridge_slave_1 entered promiscuous mode [ 28.293139][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.300488][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.308071][ T290] device bridge_slave_0 entered promiscuous mode [ 28.346504][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.353651][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.361336][ T290] device bridge_slave_1 entered promiscuous mode [ 28.437015][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.444181][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.451728][ T291] device bridge_slave_0 entered promiscuous mode [ 28.485529][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.492666][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.500126][ T291] device bridge_slave_1 entered promiscuous mode [ 28.557936][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.565035][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.656969][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.664332][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.671623][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.678699][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.690810][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.697908][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.705210][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.712281][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.721273][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.728357][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.735836][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.742910][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.769592][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.777275][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.784956][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.792398][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.799878][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.807385][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.814837][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.823932][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.831490][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.855330][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.863865][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.872224][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.879313][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.904441][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.912905][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.919942][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.953574][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.961059][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.969671][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.976733][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.985481][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.993884][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.000921][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.008435][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.038312][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.046223][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.055276][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.080797][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.089312][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.097448][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.105960][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.113082][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.120856][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.129030][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.137443][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.144538][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.151949][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.160347][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.167431][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.174937][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.183479][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.191733][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.198834][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.206321][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.215085][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.223488][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.230574][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.238069][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.246717][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.255205][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.262248][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.269890][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.287153][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.295474][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.303769][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.334566][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.343635][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.351670][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.360461][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.369206][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.377418][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.386033][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.394433][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.402404][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.410667][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.419040][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.427368][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.436100][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.446724][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.454726][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.462878][ T287] device veth0_vlan entered promiscuous mode [ 29.481969][ T291] device veth0_vlan entered promiscuous mode [ 29.490525][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.499099][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.506974][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.514813][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.523348][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.531770][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.543580][ T289] device veth0_vlan entered promiscuous mode [ 29.553152][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.561645][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.570270][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.583079][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.590646][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.603073][ T287] device veth1_macvtap entered promiscuous mode [ 29.614942][ T288] device veth0_vlan entered promiscuous mode [ 29.621861][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.630353][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.638740][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.646872][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.655034][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.663349][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.671284][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.679634][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.687343][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.694973][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.702459][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.711308][ T290] device veth0_vlan entered promiscuous mode [ 29.726051][ T291] device veth1_macvtap entered promiscuous mode [ 29.735679][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.744170][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.752520][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.761243][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.770294][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.794363][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 29.806073][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.815789][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.824337][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.832959][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.842058][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.850799][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.864194][ T289] device veth1_macvtap entered promiscuous mode [ 29.871721][ T290] device veth1_macvtap entered promiscuous mode [ 29.882840][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.898860][ T288] device veth1_macvtap entered promiscuous mode [ 29.920485][ T310] loop3: detected capacity change from 0 to 1024 [ 29.928178][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.938038][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.946344][ T310] EXT4-fs: Ignoring removed orlov option [ 29.948032][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.961393][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.971018][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.979692][ T310] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 29.979953][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.993855][ T310] EXT4-fs (loop3): orphan cleanup on readonly fs [ 29.998252][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.007016][ T310] EXT4-fs error (device loop3): __ext4_get_inode_loc:4522: comm syz.3.4: Invalid inode table block 0 in block_group 0 [ 30.011587][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.034891][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.041522][ T310] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 30.061838][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.070479][ T310] EXT4-fs error (device loop3): ext4_quota_write:7240: inode #3: comm syz.3.4: mark_inode_dirty error [ 30.092202][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.099385][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.111947][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.120728][ T310] EXT4-fs error (device loop3): ext4_acquire_dquot:6828: comm syz.3.4: Failed to acquire dquot type 0 [ 30.150056][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.158646][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.167459][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.173144][ T310] EXT4-fs error (device loop3): __ext4_get_inode_loc:4522: comm syz.3.4: Invalid inode table block 0 in block_group 0 [ 30.183068][ T318] loop0: detected capacity change from 0 to 1024 [ 30.217319][ T318] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 30.232125][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.243329][ T310] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 30.243332][ T318] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 30.262900][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.264548][ T321] loop2: detected capacity change from 0 to 2048 [ 30.276274][ T310] EXT4-fs error (device loop3): ext4_ext_truncate:4475: inode #15: comm syz.3.4: mark_inode_dirty error [ 30.287790][ T318] EXT4-fs (loop0): invalid journal inode [ 30.294513][ T318] EXT4-fs (loop0): can't get journal size [ 30.315093][ T318] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 30.325295][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.352167][ T310] EXT4-fs error (device loop3): __ext4_get_inode_loc:4522: comm syz.3.4: Invalid inode table block 0 in block_group 0 [ 30.374274][ T289] EXT4-fs error (device loop0): ext4_readdir:263: inode #2: block 37: comm syz-executor: path /0/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 30.403215][ T321] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 30.405532][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.438917][ T310] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 30.449068][ T330] device syzkaller0 entered promiscuous mode [ 30.455920][ T319] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 30.472762][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.473111][ T319] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 30.479306][ T310] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 30.492084][ T319] EXT4-fs (loop2): This should not happen!! Data will be lost [ 30.492084][ T319] [ 30.510290][ T289] EXT4-fs error (device loop0): ext4_readdir:263: inode #2: block 3: comm syz-executor: path /0/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=511, rec_len=65535, size=1024 fake=0 [ 30.552716][ T319] EXT4-fs (loop2): Total free blocks count 0 [ 30.558757][ T319] EXT4-fs (loop2): Free/Dirty block details [ 30.584089][ T319] EXT4-fs (loop2): free_blocks=4096 [ 30.589456][ T319] EXT4-fs (loop2): dirty_blocks=64 [ 30.612700][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.619346][ T310] EXT4-fs error (device loop3): __ext4_get_inode_loc:4522: comm syz.3.4: Invalid inode table block 0 in block_group 0 [ 30.631888][ T319] EXT4-fs (loop2): Block reservation details [ 30.638159][ T319] EXT4-fs (loop2): i_reserved_data_blocks=4 [ 30.653705][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.660281][ T310] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 30.675159][ T319] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 64 with error 28 [ 30.693043][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.699594][ T310] EXT4-fs error (device loop3): ext4_truncate:4327: inode #15: comm syz.3.4: mark_inode_dirty error [ 30.712884][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.727463][ T310] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 30.763044][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 30.769885][ T310] EXT4-fs (loop3): 1 truncate cleaned up [ 30.776003][ T310] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 30.817424][ T310] EXT4-fs error (device loop3): ext4_search_dir:1549: inode #2: block 16: comm syz.3.4: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 30.864798][ T287] EXT4-fs (loop3): unmounting filesystem. [ 30.918175][ T329] EXT4-fs (loop0): unmounting filesystem. [ 30.924027][ T28] kauditd_printk_skb: 50 callbacks suppressed [ 30.924044][ T28] audit: type=1400 audit(1792039316.439:122): avc: denied { create } for pid=339 comm="syz.3.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 30.954496][ T320] syz.4.6 (320) used greatest stack depth: 20704 bytes left [ 30.961902][ T28] audit: type=1400 audit(1792039316.439:123): avc: denied { getopt } for pid=339 comm="syz.3.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 31.036363][ T341] loop2: detected capacity change from 0 to 8192 [ 31.043718][ T341] ======================================================= [ 31.043718][ T341] WARNING: The mand mount option has been deprecated and [ 31.043718][ T341] and is ignored by this kernel. Remove the mand [ 31.043718][ T341] option from the mount to silence this warning. [ 31.043718][ T341] ======================================================= [ 31.126969][ T351] Zero length message leads to an empty skb [ 31.642846][ T28] audit: type=1400 audit(1792039316.659:124): avc: denied { mount } for pid=347 comm="syz.1.16" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 31.776991][ T341] syz.2.12: attempt to access beyond end of device [ 31.776991][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 31.792853][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 31.804636][ T28] audit: type=1400 audit(1792039316.659:125): avc: denied { search } for pid=347 comm="syz.1.16" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 31.827770][ T341] syz.2.12: attempt to access beyond end of device [ 31.827770][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 31.841414][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 31.881299][ T357] loop4: detected capacity change from 0 to 1024 [ 31.889227][ T341] syz.2.12: attempt to access beyond end of device [ 31.889227][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 31.902906][ T28] audit: type=1400 audit(1792039316.659:126): avc: denied { read write } for pid=347 comm="syz.1.16" name="inject" dev="tracefs" ino=8026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 31.942823][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 31.954833][ T357] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 31.993057][ T28] audit: type=1400 audit(1792039316.659:127): avc: denied { read write open } for pid=347 comm="syz.1.16" path="/2/trace/events/dwc3/dwc3_ctrl_req/inject" dev="tracefs" ino=8026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 32.003657][ T341] syz.2.12: attempt to access beyond end of device [ 32.003657][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.035078][ T357] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 2: comm syz.4.18: lblock 2 mapped to illegal pblock 2 (length 1) [ 32.082884][ T357] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 32.091073][ T357] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 48: comm syz.4.18: lblock 0 mapped to illegal pblock 48 (length 1) [ 32.106432][ T28] audit: type=1400 audit(1792039317.109:128): avc: denied { name_bind } for pid=347 comm="syz.1.16" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 32.150048][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.163000][ T357] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 32.171828][ T357] EXT4-fs error (device loop4): ext4_acquire_dquot:6828: comm syz.4.18: Failed to acquire dquot type 0 [ 32.183824][ T28] audit: type=1400 audit(1792039317.109:129): avc: denied { node_bind } for pid=347 comm="syz.1.16" saddr=224.0.0.1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 32.205752][ T341] syz.2.12: attempt to access beyond end of device [ 32.205752][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.219569][ T357] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 32.231733][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.252887][ T357] EXT4-fs error (device loop4): ext4_evict_inode:281: inode #11: comm syz.4.18: mark_inode_dirty error [ 32.267635][ T340] syz.2.12: attempt to access beyond end of device [ 32.267635][ T340] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.278120][ T357] EXT4-fs warning (device loop4): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 32.293357][ T357] EXT4-fs (loop4): 1 orphan inode deleted [ 32.299205][ T357] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 32.312981][ T353] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 32.340527][ T353] EXT4-fs error (device loop4): ext4_release_dquot:6864: comm kworker/u4:4: Failed to release dquot type 0 [ 32.352266][ T340] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.373977][ T340] syz.2.12: attempt to access beyond end of device [ 32.373977][ T340] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.389742][ T8] device bridge_slave_1 left promiscuous mode [ 32.396008][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.408695][ T340] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.414205][ T291] EXT4-fs (loop4): unmounting filesystem. [ 32.417532][ T341] syz.2.12: attempt to access beyond end of device [ 32.417532][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.423227][ T37] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 32.436688][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.458948][ T340] syz.2.12: attempt to access beyond end of device [ 32.458948][ T340] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.472288][ T340] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.473447][ T8] device bridge_slave_0 left promiscuous mode [ 32.480813][ T341] syz.2.12: attempt to access beyond end of device [ 32.480813][ T341] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 32.500009][ T341] Buffer I/O error on dev loop2, logical block 57847, async page read [ 32.508558][ T37] EXT4-fs error (device loop4): ext4_release_dquot:6864: comm kworker/u4:2: Failed to release dquot type 0 [ 32.512986][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.527916][ T291] EXT4-fs error (device loop4): __ext4_get_inode_loc:4522: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 32.547829][ T291] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 32.561970][ T8] device veth1_macvtap left promiscuous mode [ 32.579293][ T291] EXT4-fs error (device loop4): ext4_quota_off:7134: inode #3: comm syz-executor: mark_inode_dirty error [ 32.591039][ T8] device veth0_vlan left promiscuous mode [ 32.606011][ T373] loop1: detected capacity change from 0 to 128 [ 32.692569][ T380] loop3: detected capacity change from 0 to 2048 [ 32.733326][ T380] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 32.741975][ T380] ext4 filesystem being mounted at /6/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.780796][ T287] EXT4-fs (loop3): unmounting filesystem. [ 32.805455][ T388] loop2: detected capacity change from 0 to 512 [ 32.873791][ T388] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 32.887859][ T388] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.913950][ T388] EXT4-fs (loop2): shut down requested (0) [ 32.944469][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.945750][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 32.951638][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.953568][ T362] device bridge_slave_0 entered promiscuous mode [ 32.975274][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 32.984412][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=14 [ 32.995160][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.033729][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.315733][ T362] device bridge_slave_1 entered promiscuous mode [ 33.332978][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 33.345874][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 33.357472][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 33.366431][ T388] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=14 [ 33.490812][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.503090][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.513010][ T416] ip_tables: iptables: counters copy to user failed while replacing table [ 33.522048][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.537035][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 33.548654][ T418] netlink: 72 bytes leftover after parsing attributes in process `syz.4.40'. [ 33.553470][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.557961][ T418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.40'. [ 33.564522][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.572567][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.579488][ T418] netlink: 8 bytes leftover after parsing attributes in process `syz.4.40'. [ 33.584462][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 33.592185][ T418] netlink: 8 bytes leftover after parsing attributes in process `syz.4.40'. [ 33.599144][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.621239][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.629114][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 33.647615][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 33.701809][ T362] device veth0_vlan entered promiscuous mode [ 33.716089][ T362] device veth1_macvtap entered promiscuous mode [ 33.739345][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.758246][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.774972][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.783810][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.791402][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.799970][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.809011][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 33.821586][ T423] loop1: detected capacity change from 0 to 512 [ 33.829360][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.847771][ T433] loop4: detected capacity change from 0 to 1024 [ 33.859281][ T433] EXT4-fs: Ignoring removed i_version option [ 33.867418][ T433] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 33.880042][ T433] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 33.889869][ T433] EXT4-fs (loop4): orphan cleanup on readonly fs [ 33.903585][ T433] EXT4-fs error (device loop4): ext4_free_blocks:6220: comm syz.4.46: Freeing blocks not in datazone - block = 0, count = 4096 [ 33.912042][ T290] EXT4-fs (loop2): unmounting filesystem. [ 33.921554][ T423] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 33.948978][ T423] FAT-fs (loop1): Filesystem has been set read-only [ 33.955873][ T433] EXT4-fs (loop4): Remounting filesystem read-only [ 33.967716][ T433] EXT4-fs (loop4): 1 orphan inode deleted [ 33.974603][ T433] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 34.111444][ T449] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 34.170313][ T362] EXT4-fs (loop5): unmounting filesystem. [ 34.210564][ T456] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 34.257965][ T291] EXT4-fs (loop4): unmounting filesystem. [ 34.266077][ T456] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 34.277368][ T460] FAULT_INJECTION: forcing a failure. [ 34.277368][ T460] name failslab, interval 1, probability 0, space 0, times 0 [ 34.290696][ T460] CPU: 1 PID: 460 Comm: syz.1.56 Not tainted syzkaller #0 [ 34.297879][ T460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 34.307980][ T460] Call Trace: [ 34.311290][ T460] [ 34.314257][ T460] __dump_stack+0x21/0x24 [ 34.318839][ T460] dump_stack_lvl+0x110/0x170 [ 34.323559][ T460] ? __cfi_dump_stack_lvl+0x8/0x8 [ 34.328626][ T460] dump_stack+0x15/0x24 [ 34.332825][ T460] should_fail_ex+0x3bf/0x510 [ 34.337543][ T460] ? sk_prot_alloc+0x5f/0x320 [ 34.342265][ T460] __should_failslab+0xac/0xf0 [ 34.347071][ T460] should_failslab+0x9/0x20 [ 34.351643][ T460] kmem_cache_alloc+0x3b/0x320 [ 34.356478][ T460] ? security_inode_alloc+0x33/0x120 [ 34.361805][ T460] sk_prot_alloc+0x5f/0x320 [ 34.366453][ T460] sk_alloc+0x3b/0x460 [ 34.370667][ T460] inet_create+0x5af/0xef0 [ 34.375125][ T460] __sock_create+0x39e/0x7c0 [ 34.379766][ T460] __sys_socket+0xcd/0x1a0 [ 34.384231][ T460] __x64_sys_socket+0x7a/0x90 [ 34.388963][ T460] x64_sys_call+0x449/0x9a0 [ 34.393509][ T460] do_syscall_64+0x4c/0xa0 [ 34.397211][ T456] EXT4-fs error (device loop3): ext4_ext_check_inode:520: inode #3: comm syz.3.54: pblk 0 bad header/extent: too large eh_max - magic f30a, entries 2, max 15(4), depth 0(0) [ 34.397978][ T460] ? clear_bhb_loop+0x30/0x80 [ 34.419784][ T460] ? clear_bhb_loop+0x30/0x80 [ 34.424515][ T460] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.430451][ T460] RIP: 0033:0x7f207639e559 [ 34.433352][ T456] EXT4-fs (loop3): no journal found [ 34.434914][ T460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.446287][ T456] EXT4-fs (loop3): can't get journal size [ 34.459756][ T460] RSP: 002b:00007f20771cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 34.459800][ T460] RAX: ffffffffffffffda RBX: 00007f2076625fa0 RCX: 00007f207639e559 [ 34.459816][ T460] RDX: 0000000000000002 RSI: 0000000000000003 RDI: 0000000000000002 [ 34.459829][ T460] RBP: 00007f20764358b0 R08: 0000000000000000 R09: 0000000000000000 [ 34.459841][ T460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.459854][ T460] R13: 00007f2076626038 R14: 00007f2076625fa0 R15: 00007fff843416e8 [ 34.459874][ T460] [ 34.541053][ T456] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 34.558231][ T462] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 34.568404][ T462] ext4 filesystem being mounted at /4/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.580004][ T287] EXT4-fs (loop3): unmounting filesystem. [ 34.589822][ T462] EXT4-fs error (device loop5): ext4_map_blocks:747: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 3) [ 34.605116][ T462] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 34.620435][ T462] EXT4-fs (loop5): This should not happen!! Data will be lost [ 34.620435][ T462] [ 34.634020][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.652806][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.669236][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.683675][ T476] FAT-fs (loop1): bogus number of FAT structure [ 34.689977][ T476] FAT-fs (loop1): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero [ 34.699937][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.714386][ T478] EXT4-fs error (device loop5): ext4_map_blocks:747: inode #15: block 8: comm syz.5.58: lblock 8 mapped to illegal pblock 8 (length 8) [ 34.728386][ T476] FAT-fs (loop1): Can't find a valid FAT filesystem [ 34.735363][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.749723][ T478] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 34.761434][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.766474][ T478] EXT4-fs (loop5): This should not happen!! Data will be lost [ 34.766474][ T478] [ 34.781141][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 34.799741][ T462] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.58: lblock 3 mapped to illegal pblock 3 (length 1) [ 35.036753][ T498] set_capacity_and_notify: 4 callbacks suppressed [ 35.036779][ T498] loop3: detected capacity change from 0 to 7 [ 35.050701][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.060026][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.069299][ T360] loop3: unable to read partition table [ 35.076026][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.086400][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.096226][ T498] loop3: unable to read partition table [ 35.103150][ T498] loop_reread_partitions: partition scan of loop3 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ֘ȵ4FLQkÝŠ5) failed (rc=-5) [ 35.132789][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.142220][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.151469][ T287] loop3: unable to read partition table [ 35.158475][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.168049][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.177575][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.186930][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 35.196220][ T501] loop3: unable to read partition table [ 35.202136][ T501] loop_reread_partitions: partition scan of loop3 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ֘ȵ4FLQkÝŠ5) failed (rc=-5) [ 35.286059][ T511] FAULT_INJECTION: forcing a failure. [ 35.286059][ T511] name failslab, interval 1, probability 0, space 0, times 0 [ 35.298888][ T511] CPU: 1 PID: 511 Comm: syz.3.77 Not tainted syzkaller #0 [ 35.306042][ T511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.316122][ T511] Call Trace: [ 35.319433][ T511] [ 35.322392][ T511] __dump_stack+0x21/0x24 [ 35.326770][ T511] dump_stack_lvl+0x110/0x170 [ 35.331499][ T511] ? __cfi_dump_stack_lvl+0x8/0x8 [ 35.336575][ T511] ? _raw_spin_lock+0x94/0xf0 [ 35.341301][ T511] ? __cfi__raw_spin_lock+0x10/0x10 [ 35.346547][ T511] dump_stack+0x15/0x24 [ 35.350759][ T511] should_fail_ex+0x3bf/0x510 [ 35.355512][ T511] ? __alloc_file+0x28/0x2a0 [ 35.360147][ T511] __should_failslab+0xac/0xf0 [ 35.364951][ T511] should_failslab+0x9/0x20 [ 35.369490][ T511] kmem_cache_alloc+0x3b/0x320 [ 35.374419][ T511] ? __cfi__raw_spin_lock+0x10/0x10 [ 35.379674][ T511] __alloc_file+0x28/0x2a0 [ 35.384144][ T511] alloc_empty_file+0x97/0x180 [ 35.388962][ T511] alloc_file+0x59/0x600 [ 35.393251][ T511] ? _raw_spin_unlock+0x4c/0x70 [ 35.398253][ T511] alloc_file_pseudo+0x180/0x200 [ 35.403412][ T511] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 35.409013][ T511] ? __kasan_check_write+0x14/0x20 [ 35.414297][ T511] ? clear_nlink+0x8a/0xe0 [ 35.419282][ T511] __shmem_file_setup+0x1df/0x2b0 [ 35.424356][ T511] shmem_file_setup+0x2f/0x40 [ 35.429277][ T511] __se_sys_memfd_create+0x1de/0x3c0 [ 35.434888][ T511] __x64_sys_memfd_create+0x5b/0x70 [ 35.436793][ T519] loop2: detected capacity change from 0 to 512 [ 35.440415][ T511] x64_sys_call+0x235/0x9a0 [ 35.440450][ T511] do_syscall_64+0x4c/0xa0 [ 35.440502][ T511] ? clear_bhb_loop+0x30/0x80 [ 35.440527][ T511] ? clear_bhb_loop+0x30/0x80 [ 35.440551][ T511] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.440574][ T511] RIP: 0033:0x7f7ade19e559 [ 35.440591][ T511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.440609][ T511] RSP: 002b:00007f7adf03ae08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 35.506041][ T511] RAX: ffffffffffffffda RBX: 00000000000005b1 RCX: 00007f7ade19e559 [ 35.514037][ T511] RDX: 00007f7adf03aee0 RSI: 0000000000000000 RDI: 00007f7ade235a90 [ 35.522030][ T511] RBP: 0000200000000640 R08: 00000000ffffffff R09: 0000000000000000 [ 35.530014][ T511] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000000540 [ 35.537996][ T511] R13: 00007f7adf03aee0 R14: 00007f7adf03aea0 R15: 0000200000000580 [ 35.545994][ T511] [ 35.590074][ T519] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 35.612757][ T519] ext4 filesystem being mounted at /13/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.630710][ T511] loop3: detected capacity change from 0 to 512 [ 35.651740][ T362] EXT4-fs (loop5): unmounting filesystem. [ 35.664922][ T511] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 35.682590][ T290] EXT4-fs (loop2): unmounting filesystem. [ 35.708284][ T511] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 35.737319][ T511] ext4 filesystem being mounted at /22/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.770689][ T287] EXT4-fs (loop3): unmounting filesystem. [ 35.829667][ T545] FAULT_INJECTION: forcing a failure. [ 35.829667][ T545] name failslab, interval 1, probability 0, space 0, times 0 [ 35.849357][ T545] CPU: 0 PID: 545 Comm: syz.1.91 Not tainted syzkaller #0 [ 35.856538][ T545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.866624][ T545] Call Trace: [ 35.869939][ T545] [ 35.872896][ T545] __dump_stack+0x21/0x24 [ 35.877303][ T545] dump_stack_lvl+0x110/0x170 [ 35.882048][ T545] ? __cfi_dump_stack_lvl+0x8/0x8 [ 35.887141][ T545] ? do_futex+0x2e2/0x430 [ 35.891537][ T545] dump_stack+0x15/0x24 [ 35.895763][ T545] should_fail_ex+0x3bf/0x510 [ 35.900505][ T545] ? ioctx_alloc+0x10d/0x720 [ 35.905163][ T545] __should_failslab+0xac/0xf0 [ 35.909991][ T545] should_failslab+0x9/0x20 [ 35.914542][ T545] kmem_cache_alloc+0x3b/0x320 [ 35.919361][ T545] ? __bitmap_weight+0xb9/0x110 [ 35.924365][ T545] ioctx_alloc+0x10d/0x720 [ 35.928850][ T545] __se_sys_io_setup+0x6f/0x230 [ 35.933845][ T545] __x64_sys_io_setup+0x5b/0x70 [ 35.938754][ T545] x64_sys_call+0x840/0x9a0 [ 35.943317][ T545] do_syscall_64+0x4c/0xa0 [ 35.947800][ T545] ? clear_bhb_loop+0x30/0x80 [ 35.952532][ T545] ? clear_bhb_loop+0x30/0x80 [ 35.957286][ T545] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.963232][ T545] RIP: 0033:0x7f207639e559 [ 35.967694][ T545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.987547][ T545] RSP: 002b:00007f20771cf028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 35.996102][ T545] RAX: ffffffffffffffda RBX: 00007f2076625fa0 RCX: 00007f207639e559 [ 36.004117][ T545] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 36.012128][ T545] RBP: 00007f20764358b0 R08: 0000000000000000 R09: 0000000000000000 [ 36.020141][ T545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.028169][ T545] R13: 00007f2076626038 R14: 00007f2076625fa0 R15: 00007fff843416e8 [ 36.036455][ T545] [ 36.123856][ T28] kauditd_printk_skb: 147 callbacks suppressed [ 36.123887][ T28] audit: type=1400 audit(1792039321.649:275): avc: denied { name_bind } for pid=561 comm="syz.1.98" src=24806 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 36.154563][ T564] loop5: detected capacity change from 0 to 1024 [ 36.259861][ T564] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 36.277467][ T362] EXT4-fs (loop5): unmounting filesystem. [ 36.404065][ T28] audit: type=1400 audit(1792039321.899:276): avc: denied { mount } for pid=567 comm="syz.4.102" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 36.465341][ T28] audit: type=1326 audit(1792039321.899:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=593 comm="syz.1.112" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=39 compat=0 ip=0x7f20763982d7 code=0x0 [ 36.524442][ T608] syz.3.118 uses obsolete (PF_INET,SOCK_PACKET) [ 36.583989][ T28] audit: type=1400 audit(1792039322.109:278): avc: denied { mount } for pid=611 comm="syz.5.120" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 36.614854][ T614] device batadv_slave_0 entered promiscuous mode [ 36.621798][ T614] netlink: 4 bytes leftover after parsing attributes in process `syz.3.121'. [ 36.635018][ T614] device batadv_slave_0 left promiscuous mode [ 36.708044][ T625] netlink: 45349 bytes leftover after parsing attributes in process `syz.2.126'. [ 36.744735][ T629] loop3: detected capacity change from 0 to 512 [ 36.754557][ T629] EXT4-fs: Ignoring removed orlov option [ 36.761328][ T629] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 36.812212][ T629] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:3861: comm syz.3.128: Allocating blocks 41-42 which overlap fs metadata [ 36.827701][ T629] Quota error (device loop3): write_blk: dquota write failed [ 36.835524][ T629] Quota error (device loop3): find_free_dqentry: Can't write quota data block 5 [ 36.845733][ T629] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:3861: comm syz.3.128: Allocating blocks 41-42 which overlap fs metadata [ 36.862523][ T629] Quota error (device loop3): write_blk: dquota write failed [ 36.870771][ T629] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 36.880945][ T629] EXT4-fs error (device loop3): ext4_acquire_dquot:6828: comm syz.3.128: Failed to acquire dquot type 1 [ 36.893469][ T629] EXT4-fs error (device loop3): mb_free_blocks:1839: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 36.914450][ T629] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #12: comm syz.3.128: corrupted inode contents [ 36.930600][ T28] audit: type=1400 audit(1792039322.449:279): avc: denied { unmount } for pid=362 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 36.945922][ T629] EXT4-fs error (device loop3): ext4_dirty_inode:6158: inode #12: comm syz.3.128: mark_inode_dirty error [ 36.967181][ T629] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #12: comm syz.3.128: corrupted inode contents [ 36.980514][ T629] EXT4-fs error (device loop3): __ext4_ext_dirty:202: inode #12: comm syz.3.128: mark_inode_dirty error [ 36.999052][ T629] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #12: comm syz.3.128: corrupted inode contents [ 37.016771][ T629] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 37.200165][ T629] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #12: comm syz.3.128: corrupted inode contents [ 37.210059][ T28] audit: type=1400 audit(1792039322.719:280): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 37.237297][ T629] EXT4-fs error (device loop3): ext4_truncate:4327: inode #12: comm syz.3.128: mark_inode_dirty error [ 37.274004][ T629] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 37.305654][ T629] EXT4-fs (loop3): 1 truncate cleaned up [ 37.311855][ T629] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 37.359056][ T638] netlink: 20 bytes leftover after parsing attributes in process `syz.5.131'. [ 37.368706][ T629] EXT4-fs error (device loop3): __ext4_remount:6637: comm syz.3.128: Abort forced by user [ 37.393460][ T638] netlink: 8 bytes leftover after parsing attributes in process `syz.5.131'. [ 37.403040][ T629] EXT4-fs (loop3): Remounting filesystem read-only [ 37.410026][ T629] EXT4-fs (loop3): re-mounted. Quota mode: writeback. [ 37.597302][ T287] EXT4-fs (loop3): unmounting filesystem. [ 37.660661][ T656] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 37.672887][ T661] FAULT_INJECTION: forcing a failure. [ 37.672887][ T661] name failslab, interval 1, probability 0, space 0, times 0 [ 37.693350][ T661] CPU: 0 PID: 661 Comm: syz.4.143 Not tainted syzkaller #0 [ 37.700599][ T661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 37.710702][ T661] Call Trace: [ 37.714008][ T661] [ 37.716959][ T661] __dump_stack+0x21/0x24 [ 37.721318][ T661] dump_stack_lvl+0x110/0x170 [ 37.726016][ T661] ? __cfi_dump_stack_lvl+0x8/0x8 [ 37.731066][ T661] ? selinux_kernfs_init_security+0x143/0x450 [ 37.737163][ T661] dump_stack+0x15/0x24 [ 37.741350][ T661] should_fail_ex+0x3bf/0x510 [ 37.746037][ T661] ? __kernfs_new_node+0xe1/0x670 [ 37.751069][ T661] __should_failslab+0xac/0xf0 [ 37.755848][ T661] should_failslab+0x9/0x20 [ 37.760367][ T661] kmem_cache_alloc+0x3b/0x320 [ 37.765156][ T661] __kernfs_new_node+0xe1/0x670 [ 37.770028][ T661] ? clear_nonspinnable+0x60/0x60 [ 37.775078][ T661] ? rwsem_write_trylock+0x136/0x300 [ 37.780391][ T661] ? kernfs_new_node+0x260/0x260 [ 37.785351][ T661] ? up_write+0x7b/0x290 [ 37.789657][ T661] kernfs_new_node+0x150/0x260 [ 37.794443][ T661] __kernfs_create_file+0x4e/0x270 [ 37.799580][ T661] sysfs_add_file_mode_ns+0x1ce/0x270 [ 37.804977][ T661] internal_create_group+0x6b7/0xeb0 [ 37.810286][ T661] ? sysfs_create_group+0x30/0x30 [ 37.815332][ T661] ? up_write+0x7b/0x290 [ 37.819601][ T661] ? kernfs_activate+0x1ea/0x200 [ 37.824557][ T661] sysfs_create_groups+0x58/0x120 [ 37.829604][ T661] device_add_attrs+0x1ae/0x830 [ 37.834500][ T661] ? get_device_parent+0x410/0x410 [ 37.839638][ T661] ? sysfs_do_create_link_sd+0xe9/0x110 [ 37.845204][ T661] device_add+0x5b0/0xec0 [ 37.849558][ T661] netdev_register_kobject+0x18e/0x330 [ 37.855032][ T661] ? raw_notifier_call_chain+0xfa/0x110 [ 37.860590][ T661] register_netdevice+0xec9/0x1550 [ 37.865721][ T661] ? __cfi_register_netdevice+0x10/0x10 [ 37.871278][ T661] ? kvmalloc_node+0x2b3/0x460 [ 37.876059][ T661] register_netdev+0x3e/0x50 [ 37.880693][ T661] register_candev+0x278/0x5f0 [ 37.885476][ T661] ? __cfi_register_candev+0x10/0x10 [ 37.890783][ T661] ? init_timer_key+0x8b/0x1b0 [ 37.895596][ T661] ? alloc_candev_mqs+0x2d0/0x3f0 [ 37.900653][ T661] slcan_open+0x329/0x420 [ 37.905024][ T661] tty_set_ldisc+0x4c3/0x780 [ 37.909653][ T661] tiocsetd+0x58/0x70 [ 37.913663][ T661] tty_ioctl+0xad3/0xc60 [ 37.917936][ T661] ? __cfi_tty_ioctl+0x10/0x10 [ 37.922721][ T661] __se_sys_ioctl+0x12f/0x1b0 [ 37.927419][ T661] __x64_sys_ioctl+0x7b/0x90 [ 37.932130][ T661] x64_sys_call+0x58b/0x9a0 [ 37.936652][ T661] do_syscall_64+0x4c/0xa0 [ 37.941174][ T661] ? clear_bhb_loop+0x30/0x80 [ 37.945865][ T661] ? clear_bhb_loop+0x30/0x80 [ 37.950559][ T661] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.956470][ T661] RIP: 0033:0x7f218819e559 [ 37.960905][ T661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.980626][ T661] RSP: 002b:00007f2189003028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 37.989056][ T661] RAX: ffffffffffffffda RBX: 00007f2188425fa0 RCX: 00007f218819e559 [ 37.997043][ T661] RDX: 0000200000000100 RSI: 0000000000005423 RDI: 0000000000000004 [ 38.005021][ T661] RBP: 00007f21882358b0 R08: 0000000000000000 R09: 0000000000000000 [ 38.012999][ T661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.020984][ T661] R13: 00007f2188426038 R14: 00007f2188425fa0 R15: 00007ffe461ebbf8 [ 38.029059][ T661] [ 38.054920][ T661] slcan: can't register candev [ 38.200914][ T694] loop4: detected capacity change from 0 to 1024 [ 38.327369][ T701] loop2: detected capacity change from 0 to 1024 [ 38.352287][ T694] loop4: detected capacity change from 0 to 2048 [ 38.383479][ T694] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 38.426883][ T701] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 2: comm syz.2.160: lblock 2 mapped to illegal pblock 2 (length 1) [ 38.478708][ T701] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 48: comm syz.2.160: lblock 0 mapped to illegal pblock 48 (length 1) [ 38.523976][ T701] EXT4-fs error (device loop2): ext4_acquire_dquot:6828: comm syz.2.160: Failed to acquire dquot type 0 [ 38.573900][ T701] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 38.584182][ T701] EXT4-fs error (device loop2): ext4_evict_inode:281: inode #11: comm syz.2.160: mark_inode_dirty error [ 38.597033][ T701] EXT4-fs warning (device loop2): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 38.608259][ T701] EXT4-fs (loop2): 1 orphan inode deleted [ 38.614614][ T701] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 38.623800][ T37] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 38.675420][ T37] EXT4-fs error (device loop2): ext4_release_dquot:6864: comm kworker/u4:2: Failed to release dquot type 0 [ 38.715818][ T290] EXT4-fs (loop2): unmounting filesystem. [ 38.732333][ T37] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 38.747244][ T37] EXT4-fs error (device loop2): ext4_release_dquot:6864: comm kworker/u4:2: Failed to release dquot type 0 [ 38.760533][ T290] EXT4-fs error (device loop2): __ext4_get_inode_loc:4522: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 38.790003][ T290] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 38.812287][ T290] EXT4-fs error (device loop2): ext4_quota_off:7134: inode #3: comm syz-executor: mark_inode_dirty error [ 38.986482][ T719] netlink: 'syz.4.157': attribute type 9 has an invalid length. [ 38.996338][ T719] netlink: 'syz.4.157': attribute type 7 has an invalid length. [ 39.100004][ T719] netlink: 'syz.4.157': attribute type 8 has an invalid length. [ 39.109831][ T727] FAULT_INJECTION: forcing a failure. [ 39.109831][ T727] name failslab, interval 1, probability 0, space 0, times 0 [ 39.124358][ T727] CPU: 1 PID: 727 Comm: syz.2.171 Not tainted syzkaller #0 [ 39.131628][ T727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 39.141721][ T727] Call Trace: [ 39.145032][ T727] [ 39.147993][ T727] __dump_stack+0x21/0x24 [ 39.152377][ T727] dump_stack_lvl+0x110/0x170 [ 39.157107][ T727] ? __cfi_dump_stack_lvl+0x8/0x8 [ 39.162267][ T727] ? __cfi_fib6_clean_all+0x10/0x10 [ 39.167503][ T727] dump_stack+0x15/0x24 [ 39.171708][ T727] should_fail_ex+0x3bf/0x510 [ 39.176516][ T727] __should_failslab+0xac/0xf0 [ 39.181331][ T727] should_failslab+0x9/0x20 [ 39.185954][ T727] kmem_cache_alloc_node+0x42/0x330 [ 39.191207][ T727] ? __alloc_skb+0xe8/0x4a0 [ 39.195771][ T727] __alloc_skb+0xe8/0x4a0 [ 39.200146][ T727] rtmsg_ifinfo_build_skb+0x75/0x180 [ 39.205479][ T727] rtmsg_ifinfo+0x7a/0x130 [ 39.209963][ T727] netdev_state_change+0x190/0x230 [ 39.215125][ T727] ? __cfi_netdev_state_change+0x10/0x10 [ 39.220804][ T727] ? dev_change_flags+0xe3/0x1a0 [ 39.225811][ T727] do_setlink+0x7d1/0x2a10 [ 39.230262][ T727] ? kasan_set_track+0x4b/0x70 [ 39.235064][ T727] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 39.241256][ T727] ? rtnetlink_rcv_msg+0xb28/0xde0 [ 39.246410][ T727] ? __nla_validate_parse+0x1f75/0x2980 [ 39.252011][ T727] ? __nla_validate+0x60/0x60 [ 39.256731][ T727] rtnl_newlink+0x10b3/0x20d0 [ 39.261456][ T727] ? rtnl_newlink+0xb51/0x20d0 [ 39.266466][ T727] ? __cfi_rtnl_newlink+0x10/0x10 [ 39.271544][ T727] ? selinux_capable+0x2b6/0x3b0 [ 39.276529][ T727] ? __cfi_selinux_capable+0x10/0x10 [ 39.281876][ T727] ? __cfi_mutex_lock+0x10/0x10 [ 39.286770][ T727] ? ns_capable+0x8c/0xf0 [ 39.291142][ T727] ? netlink_net_capable+0x125/0x160 [ 39.296467][ T727] ? __cfi_rtnl_newlink+0x10/0x10 [ 39.301540][ T727] rtnetlink_rcv_msg+0xb28/0xde0 [ 39.306521][ T727] ? 0xffffffffa0004440 [ 39.310711][ T727] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 39.316226][ T727] ? __kernel_text_address+0xd/0x30 [ 39.321483][ T727] ? avc_has_perm_noaudit+0x390/0x490 [ 39.326896][ T727] ? memcpy+0x56/0x70 [ 39.330923][ T727] ? avc_has_perm_noaudit+0x30a/0x490 [ 39.336342][ T727] ? __cfi_avc_has_perm_noaudit+0x10/0x10 [ 39.342101][ T727] ? kasan_save_alloc_info+0x1f/0x30 [ 39.347434][ T727] ? avc_has_perm+0x163/0x250 [ 39.352182][ T727] ? __alloc_skb+0x226/0x4a0 [ 39.356850][ T727] ? netlink_sendmsg+0x635/0xbd0 [ 39.361857][ T727] ? ____sys_sendmsg+0x5fb/0x9c0 [ 39.366846][ T727] ? __cfi_avc_has_perm+0x10/0x10 [ 39.371906][ T727] ? selinux_nlmsg_lookup+0x38f/0x440 [ 39.377316][ T727] netlink_rcv_skb+0x200/0x450 [ 39.382130][ T727] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 39.387603][ T727] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 39.392994][ T727] ? __netlink_lookup+0x387/0x3b0 [ 39.398040][ T727] rtnetlink_rcv+0x1c/0x20 [ 39.402459][ T727] netlink_unicast+0x8c1/0xa60 [ 39.407231][ T727] netlink_sendmsg+0x8b9/0xbd0 [ 39.412005][ T727] ? __cfi_netlink_sendmsg+0x10/0x10 [ 39.417298][ T727] ? security_socket_sendmsg+0x93/0xb0 [ 39.422770][ T727] ? __cfi_netlink_sendmsg+0x10/0x10 [ 39.428076][ T727] ____sys_sendmsg+0x5fb/0x9c0 [ 39.432855][ T727] ? __sys_sendmsg_sock+0x40/0x40 [ 39.437886][ T727] ? import_iovec+0x7c/0xb0 [ 39.442403][ T727] ___sys_sendmsg+0x2a2/0x360 [ 39.447127][ T727] ? __sys_sendmsg+0x290/0x290 [ 39.451896][ T727] ? security_file_alloc+0x33/0x130 [ 39.457118][ T727] ? percpu_counter_add_batch+0x13c/0x160 [ 39.462840][ T727] ? __fdget+0x19c/0x220 [ 39.467080][ T727] __x64_sys_sendmsg+0x20d/0x2e0 [ 39.472022][ T727] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 39.477487][ T727] ? __kasan_check_write+0x14/0x20 [ 39.482605][ T727] ? fpregs_restore_userregs+0x128/0x260 [ 39.488288][ T727] ? switch_fpu_return+0xe/0x10 [ 39.493141][ T727] x64_sys_call+0x171/0x9a0 [ 39.497648][ T727] do_syscall_64+0x4c/0xa0 [ 39.502085][ T727] ? clear_bhb_loop+0x30/0x80 [ 39.506763][ T727] ? clear_bhb_loop+0x30/0x80 [ 39.511437][ T727] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.517330][ T727] RIP: 0033:0x7f191cf9e559 [ 39.521741][ T727] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.541345][ T727] RSP: 002b:00007f191deef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 39.549757][ T727] RAX: ffffffffffffffda RBX: 00007f191d225fa0 RCX: 00007f191cf9e559 [ 39.557728][ T727] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 39.565702][ T727] RBP: 00007f191d0358b0 R08: 0000000000000000 R09: 0000000000000000 [ 39.573701][ T727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.581949][ T727] R13: 00007f191d226038 R14: 00007f191d225fa0 R15: 00007ffe0bc88b38 [ 39.589938][ T727] [ 39.600156][ T727] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 39.625147][ T731] loop5: detected capacity change from 0 to 512 [ 39.634465][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 39.645026][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 39.675473][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 39.690510][ T731] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 39.714309][ T735] loop1: detected capacity change from 0 to 512 [ 39.717899][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 39.730426][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 39.743674][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 39.753679][ T735] EXT4-fs: Ignoring removed nobh option [ 39.757099][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 39.765904][ T731] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #11: comm syz.5.173: invalid indirect mapped block 256 (level 2) [ 39.769193][ T401] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 39.808649][ T742] FAULT_INJECTION: forcing a failure. [ 39.808649][ T742] name failslab, interval 1, probability 0, space 0, times 0 [ 39.814922][ T731] EXT4-fs (loop5): 2 truncates cleaned up [ 39.821968][ T742] CPU: 0 PID: 742 Comm: syz.4.177 Not tainted syzkaller #0 [ 39.834407][ T742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 39.836355][ T735] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 39.844496][ T742] Call Trace: [ 39.844506][ T742] [ 39.844514][ T742] __dump_stack+0x21/0x24 [ 39.844552][ T742] dump_stack_lvl+0x110/0x170 [ 39.868669][ T742] ? __cfi_dump_stack_lvl+0x8/0x8 [ 39.870438][ T731] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 39.873737][ T742] dump_stack+0x15/0x24 [ 39.873774][ T742] should_fail_ex+0x3bf/0x510 [ 39.873797][ T742] ? ep_insert+0x4b4/0x14c0 [ 39.873825][ T742] __should_failslab+0xac/0xf0 [ 39.873853][ T742] should_failslab+0x9/0x20 [ 39.873873][ T742] kmem_cache_alloc+0x3b/0x320 [ 39.893102][ T735] ext4 filesystem being mounted at /34/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.896104][ T742] ep_insert+0x4b4/0x14c0 [ 39.924827][ T742] ? ep_loop_check+0x80/0x80 [ 39.929468][ T742] ? mutex_lock+0x93/0x1b0 [ 39.933934][ T742] ? __fdget+0x19c/0x220 [ 39.938251][ T742] ? do_epoll_ctl+0x3d/0xdc0 [ 39.942887][ T742] do_epoll_ctl+0x878/0xdc0 [ 39.944367][ T731] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm syz.5.173: bg 0: block 5: invalid block bitmap [ 39.947430][ T742] __x64_sys_epoll_ctl+0x162/0x1b0 [ 39.964711][ T742] ? __cfi___x64_sys_epoll_ctl+0x10/0x10 [ 39.970393][ T742] ? fpregs_restore_userregs+0x128/0x260 [ 39.976074][ T742] ? switch_fpu_return+0xe/0x10 [ 39.981010][ T742] x64_sys_call+0x839/0x9a0 [ 39.985550][ T742] do_syscall_64+0x4c/0xa0 [ 39.990012][ T742] ? clear_bhb_loop+0x30/0x80 [ 39.993587][ T731] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 39.994721][ T742] ? clear_bhb_loop+0x30/0x80 [ 40.011590][ T742] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 40.017551][ T742] RIP: 0033:0x7f218819e559 [ 40.022008][ T742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.029967][ T731] EXT4-fs (loop5): This should not happen!! Data will be lost [ 40.029967][ T731] [ 40.041638][ T742] RSP: 002b:00007f2189003028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 40.041679][ T742] RAX: ffffffffffffffda RBX: 00007f2188425fa0 RCX: 00007f218819e559 [ 40.041695][ T742] RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006 [ 40.041707][ T742] RBP: 00007f21882358b0 R08: 0000000000000000 R09: 0000000000000000 [ 40.083890][ T742] R10: 0000200000000940 R11: 0000000000000246 R12: 0000000000000000 [ 40.091944][ T742] R13: 00007f2188426038 R14: 00007f2188425fa0 R15: 00007ffe461ebbf8 [ 40.099958][ T742] [ 40.112981][ T731] EXT4-fs (loop5): Total free blocks count 0 [ 40.131448][ T731] EXT4-fs (loop5): Free/Dirty block details [ 40.156543][ T731] EXT4-fs (loop5): free_blocks=0 [ 40.161736][ T288] EXT4-fs (loop1): unmounting filesystem. [ 40.189500][ T731] EXT4-fs (loop5): dirty_blocks=65 [ 40.196338][ T731] EXT4-fs (loop5): Block reservation details [ 40.202451][ T731] EXT4-fs (loop5): i_reserved_data_blocks=65 [ 40.222814][ T401] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 63 with error 28 [ 40.242961][ T762] loop4: detected capacity change from 0 to 1024 [ 42.724656][ T764] loop2: detected capacity change from 0 to 1024 [ 42.733209][ T771] loop5: detected capacity change from 0 to 512 [ 42.741600][ T764] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 42.755886][ T762] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 42.765085][ T762] ext4 filesystem being mounted at /30/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.777358][ T771] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 42.787942][ T771] FAT-fs (loop5): Filesystem has been set read-only [ 42.794857][ T28] kauditd_printk_skb: 40 callbacks suppressed [ 42.794873][ T28] audit: type=1400 audit(1792039328.319:317): avc: denied { execute } for pid=761 comm="syz.4.186" path="/30/file1/file1" dev="loop4" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 42.797664][ T771] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 42.802271][ T761] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 42.855981][ T762] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 42.869502][ T764] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 2: comm syz.2.188: lblock 2 mapped to illegal pblock 2 (length 1) [ 42.911881][ T762] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 42.916337][ T778] loop5: detected capacity change from 0 to 7 [ 42.931407][ T764] Quota error (device loop2): qtree_write_dquot: dquota write failed [ 42.935004][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 42.941408][ T764] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 48: comm syz.2.188: lblock 0 mapped to illegal pblock 48 (length 1) [ 42.964287][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 42.981771][ T37] loop: Write error at byte offset 4, length 3584. [ 42.988612][ C0] blk_print_req_error: 9 callbacks suppressed [ 42.988637][ C0] I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 43.004196][ C0] buffer_io_error: 2799 callbacks suppressed [ 43.004226][ C0] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 43.022426][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 43.037548][ T764] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 43.077131][ T764] EXT4-fs error (device loop2): ext4_acquire_dquot:6828: comm syz.2.188: Failed to acquire dquot type 0 [ 43.327294][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 43.401950][ T764] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 43.411525][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 43.432911][ T764] EXT4-fs error (device loop2): ext4_evict_inode:281: inode #11: comm syz.2.188: mark_inode_dirty error [ 43.444551][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 43.458467][ T761] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.186: lblock 0 mapped to illegal pblock 0 (length 1) [ 43.471827][ T764] EXT4-fs warning (device loop2): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 43.493748][ T764] EXT4-fs (loop2): 1 orphan inode deleted [ 43.499595][ T764] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 43.778759][ T37] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 44.472632][ C1] sched: RT throttling activated [ 44.487803][ T37] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 44.496626][ T37] EXT4-fs error (device loop2): ext4_release_dquot:6864: comm kworker/u4:2: Failed to release dquot type 0 [ 44.511505][ T291] EXT4-fs (loop4): unmounting filesystem. [ 45.493898][ T28] audit: type=1326 audit(1792039331.019:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=796 comm="syz.4.195" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f218819e559 code=0x0 [ 45.518730][ T795] loop1: detected capacity change from 0 to 1024 [ 46.476560][ T795] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 46.487614][ T795] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 46.497445][ T795] EXT4-fs (loop1): invalid journal inode [ 46.503264][ T795] EXT4-fs (loop1): can't get journal size [ 46.510315][ T795] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 46.524847][ T290] EXT4-fs (loop2): unmounting filesystem. [ 46.535305][ T801] Driver unsupported XDP return value 0 on prog (id 10) dev N/A, expect packet loss! [ 46.541492][ T290] EXT4-fs error (device loop2): __ext4_get_inode_loc:4522: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 46.568324][ T803] netlink: 52 bytes leftover after parsing attributes in process `syz.5.200'. [ 46.577732][ T803] netlink: 56 bytes leftover after parsing attributes in process `syz.5.200'. [ 46.577989][ T290] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 46.605408][ T290] EXT4-fs error (device loop2): ext4_quota_off:7134: inode #3: comm syz-executor: mark_inode_dirty error [ 46.628610][ T28] audit: type=1400 audit(1792039332.149:319): avc: denied { read } for pid=808 comm="syz.5.203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 49.039322][ T810] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 37: comm syz.1.197: path /40/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 49.061190][ T810] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 3: comm syz.1.197: path /40/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=511, rec_len=65535, size=1024 fake=0 [ 49.104441][ T28] audit: type=1400 audit(1792039334.629:320): avc: denied { ioctl } for pid=814 comm="syz.5.204" path="socket:[17317]" dev="sockfs" ino=17317 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 49.206703][ T288] EXT4-fs (loop1): unmounting filesystem. [ 49.289807][ T830] loop1: detected capacity change from 0 to 1024 [ 49.308897][ T830] EXT4-fs: Ignoring removed orlov option [ 49.351608][ T839] loop5: detected capacity change from 0 to 512 [ 49.376121][ T830] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 49.392298][ T28] audit: type=1400 audit(1792039334.909:321): avc: denied { remove_name } for pid=829 comm="syz.1.209" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 50.023856][ T842] loop4: detected capacity change from 0 to 1024 [ 50.027727][ T28] audit: type=1400 audit(1792039335.319:322): avc: denied { rename } for pid=829 comm="syz.1.209" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 50.103048][ T842] ext3: Unknown parameter 'noacl' [ 50.117545][ T288] EXT4-fs (loop1): unmounting filesystem. [ 50.127598][ T28] audit: type=1400 audit(1792039335.329:323): avc: denied { unlink } for pid=829 comm="syz.1.209" name="file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 50.163921][ T855] loop2: detected capacity change from 0 to 1024 [ 50.177573][ T362] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 50.205137][ T28] audit: type=1400 audit(1792039335.429:324): avc: denied { mounton } for pid=838 comm="syz.5.212" path="/38/file0/sys_mount" dev="loop5" ino=1048665 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 50.220349][ T859] loop1: detected capacity change from 0 to 512 [ 50.238047][ T855] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 50.249503][ T362] FAT-fs (loop5): Filesystem has been set read-only [ 50.262728][ T855] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 50.266208][ T28] audit: type=1400 audit(1792039335.629:325): avc: denied { mounton } for pid=841 comm="syz.4.213" path="/syzcgroup/unified/syz4" dev="cgroup2" ino=47 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 50.283126][ T362] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 50.309714][ T855] EXT4-fs (loop2): invalid journal inode [ 50.338809][ T855] EXT4-fs (loop2): can't get journal size [ 50.345309][ T859] EXT4-fs (loop1): Test dummy encryption mode enabled [ 50.355181][ T859] EXT4-fs error (device loop1): ext4_orphan_get:1405: inode #11: comm syz.1.214: casefold flag without casefold feature [ 50.368305][ T855] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 50.380169][ T859] EXT4-fs error (device loop1): ext4_orphan_get:1410: comm syz.1.214: couldn't read orphan inode 11 (err -117) [ 50.398498][ T859] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 50.545366][ T288] EXT4-fs (loop1): unmounting filesystem. [ 50.649608][ T28] audit: type=1400 audit(100.960:326): avc: denied { mounton } for pid=876 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 50.671006][ T28] audit: type=1400 audit(100.960:327): avc: denied { create } for pid=876 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 50.783572][ T28] audit: type=1400 audit(101.090:328): avc: denied { create } for pid=869 comm="syz.4.222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 50.810164][ T876] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.818038][ T876] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.826222][ T876] device bridge_slave_0 entered promiscuous mode [ 50.835357][ T876] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.842425][ T876] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.853298][ T876] device bridge_slave_1 entered promiscuous mode [ 50.917536][ T876] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.924608][ T876] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.931925][ T876] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.939013][ T876] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.965687][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.975520][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.983266][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.999567][ T290] EXT4-fs (loop2): unmounting filesystem. [ 51.008575][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.018294][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 51.028173][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.035286][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.038339][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 51.044524][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.059664][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.066773][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.083903][ T8] device bridge_slave_1 left promiscuous mode [ 51.090087][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.098122][ T8] device bridge_slave_0 left promiscuous mode [ 51.104637][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.345823][ T8] device veth1_macvtap left promiscuous mode [ 52.352232][ T8] device veth0_vlan left promiscuous mode [ 52.501069][ T902] FAULT_INJECTION: forcing a failure. [ 52.501069][ T902] name failslab, interval 1, probability 0, space 0, times 0 [ 52.523984][ T907] loop4: detected capacity change from 0 to 512 [ 52.531874][ T360] udevd[360]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 52.532734][ T902] CPU: 0 PID: 902 Comm: syz.3.230 Not tainted syzkaller #0 [ 52.547765][ T902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 52.557850][ T902] Call Trace: [ 52.561156][ T902] [ 52.564118][ T902] __dump_stack+0x21/0x24 [ 52.568512][ T902] dump_stack_lvl+0x110/0x170 [ 52.573216][ T902] ? __cfi_dump_stack_lvl+0x8/0x8 [ 52.578297][ T902] dump_stack+0x15/0x24 [ 52.582478][ T902] should_fail_ex+0x3bf/0x510 [ 52.587174][ T902] __should_failslab+0xac/0xf0 [ 52.591964][ T902] should_failslab+0x9/0x20 [ 52.596511][ T902] __kmem_cache_alloc_node+0x3d/0x2d0 [ 52.601909][ T902] ? copy_net_ns+0x10f/0x5c0 [ 52.606522][ T902] ? copy_net_ns+0x10f/0x5c0 [ 52.611127][ T902] __kmalloc+0xa4/0x1e0 [ 52.615306][ T902] copy_net_ns+0x10f/0x5c0 [ 52.619741][ T902] ? __kasan_check_write+0x14/0x20 [ 52.624884][ T902] ? copy_cgroup_ns+0x91/0x4c0 [ 52.629676][ T902] create_new_namespaces+0x3a8/0x660 [ 52.634991][ T902] unshare_nsproxy_namespaces+0x120/0x170 [ 52.640733][ T902] ksys_unshare+0x4d5/0x850 [ 52.645264][ T902] ? __cfi_ksys_unshare+0x10/0x10 [ 52.650315][ T902] ? fpregs_restore_userregs+0x128/0x260 [ 52.655963][ T902] __x64_sys_unshare+0x38/0x40 [ 52.660749][ T902] x64_sys_call+0x767/0x9a0 [ 52.665275][ T902] do_syscall_64+0x4c/0xa0 [ 52.669721][ T902] ? clear_bhb_loop+0x30/0x80 [ 52.674409][ T902] ? clear_bhb_loop+0x30/0x80 [ 52.679127][ T902] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 52.685039][ T902] RIP: 0033:0x7f7ade19e559 [ 52.689473][ T902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.709088][ T902] RSP: 002b:00007f7adf03b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 52.717517][ T902] RAX: ffffffffffffffda RBX: 00007f7ade425fa0 RCX: 00007f7ade19e559 [ 52.725590][ T902] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040040400 [ 52.733576][ T902] RBP: 00007f7ade2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 52.741560][ T902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 52.749550][ T902] R13: 00007f7ade426038 R14: 00007f7ade425fa0 R15: 00007ffea2ad4838 [ 52.757628][ T902] [ 52.762250][ T907] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 52.786701][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.793975][ T907] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e002e018, mo2=0082] [ 52.802606][ T907] System zones: 0-2, 18-18, 34-34 [ 52.810154][ T907] EXT4-fs (loop4): 1 orphan inode deleted [ 52.816235][ T907] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 52.832706][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 52.841056][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.849055][ T37] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 52.858724][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 52.867823][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 52.873927][ T37] EXT4-fs error (device loop4): ext4_release_dquot:6864: comm kworker/u4:2: Failed to release dquot type 1 [ 52.900311][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 52.912489][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 52.924139][ T876] device veth0_vlan entered promiscuous mode [ 52.933100][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 52.940943][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.968317][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 52.981558][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.985497][ T291] EXT4-fs (loop4): unmounting filesystem. [ 52.997585][ T876] device veth1_macvtap entered promiscuous mode [ 53.029342][ T917] loop3: detected capacity change from 0 to 1024 [ 53.043681][ T917] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 53.056035][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 53.073441][ T917] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 53.087183][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 53.096620][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 53.104822][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 53.107562][ T360] udevd[360]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 53.113412][ T917] EXT4-fs (loop3): invalid journal inode [ 53.127836][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 53.138617][ T360] udevd[360]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 53.143709][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 53.150111][ T917] EXT4-fs (loop3): can't get journal size [ 53.163779][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 53.256623][ T917] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 53.809487][ T928] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 37: comm syz.3.238: path /51/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 54.080804][ T287] EXT4-fs (loop3): unmounting filesystem. [ 54.092781][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 54.107271][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 54.130206][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 54.130223][ T28] audit: type=1400 audit(104.440:330): avc: denied { ioctl } for pid=933 comm="syz.3.241" path="/dev/ptp0" dev="devtmpfs" ino=264 ioctlcmd=0x3d02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 54.564355][ T8] device bridge_slave_1 left promiscuous mode [ 54.573549][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.588891][ T8] device bridge_slave_0 left promiscuous mode [ 54.600590][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.624048][ T8] device veth1_macvtap left promiscuous mode [ 54.637882][ T8] device veth0_vlan left promiscuous mode [ 54.751531][ T960] netlink: 88 bytes leftover after parsing attributes in process `syz.1.250'. [ 55.257366][ T969] loop3: detected capacity change from 0 to 512 [ 55.278623][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 55.288941][ T970] rtc_cmos 00:00: Alarms can be up to one day in the future [ 55.318520][ T969] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 55.335257][ T28] audit: type=1400 audit(105.650:331): avc: denied { create } for pid=968 comm="syz.3.253" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=fifo_file permissive=1 [ 55.356723][ T847] rtc_cmos 00:00: Alarms can be up to one day in the future [ 55.386724][ T847] rtc_cmos 00:00: Alarms can be up to one day in the future [ 55.404218][ T287] EXT4-fs (loop3): unmounting filesystem. [ 55.410465][ T847] rtc_cmos 00:00: Alarms can be up to one day in the future [ 55.436808][ T847] rtc_cmos 00:00: Alarms can be up to one day in the future [ 55.448418][ T847] rtc rtc0: __rtc_set_alarm: err=-22 [ 55.454899][ T28] audit: type=1400 audit(105.740:332): avc: denied { block_suspend } for pid=981 comm="syz.2.259" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 55.525533][ T989] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 56.713773][ T28] audit: type=1400 audit(107.030:333): avc: denied { read write } for pid=995 comm="syz.3.263" name="uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 56.740165][ T847] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 56.764094][ T847] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 56.773792][ T28] audit: type=1400 audit(107.030:334): avc: denied { open } for pid=995 comm="syz.3.263" path="/dev/uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 56.972273][ T1009] udevd[1009]: open /dev/null failed: Not a directory [ 57.157962][ T1004] loop1: detected capacity change from 0 to 8192 [ 57.166015][ T312] udevd[312]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 57.176224][ T312] udevd[312]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 57.198435][ T312] udevd[312]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 57.208799][ T312] udevd[312]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 57.244860][ T1017] netlink: 56 bytes leftover after parsing attributes in process `syz.3.271'. [ 57.259307][ T1017] netlink: 20 bytes leftover after parsing attributes in process `syz.3.271'. [ 57.268676][ T1017] netlink: 24 bytes leftover after parsing attributes in process `syz.3.271'. [ 57.904906][ T28] audit: type=1400 audit(108.220:335): avc: denied { getopt } for pid=1031 comm="syz.3.276" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 57.998735][ T28] audit: type=1400 audit(108.310:336): avc: denied { create } for pid=1034 comm="syz.1.277" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 58.042362][ T28] audit: type=1400 audit(108.330:337): avc: denied { setattr } for pid=1034 comm="syz.1.277" name="XDP" dev="sockfs" ino=18875 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 58.454008][ T1046] tipc: Started in network mode [ 58.464857][ T1046] tipc: Node identity ac1414aa, cluster identity 4711 [ 58.477322][ T1046] tipc: Enabling of bearer rejected, failed to enable media [ 59.121561][ T28] audit: type=1400 audit(109.430:338): avc: denied { write } for pid=1051 comm="syz.2.283" name="snapshot" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 59.146410][ T1054] random: crng reseeded on system resumption [ 59.178180][ T28] audit: type=1400 audit(109.460:339): avc: denied { open } for pid=1051 comm="syz.2.283" path="/dev/snapshot" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 59.225026][ T1063] loop3: detected capacity change from 0 to 512 [ 59.232578][ T28] audit: type=1400 audit(109.470:340): avc: denied { setopt } for pid=1049 comm="syz.4.285" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 59.235402][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 59.279225][ T1063] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 59.284443][ T28] audit: type=1400 audit(109.520:341): avc: denied { ioctl } for pid=1051 comm="syz.2.283" path="/dev/snapshot" dev="devtmpfs" ino=91 ioctlcmd=0x330f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 59.295780][ T1063] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 59.346090][ T28] audit: type=1400 audit(109.660:342): avc: denied { connect } for pid=1066 comm="syz.1.292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 59.367678][ T1071] loop1: detected capacity change from 0 to 512 [ 59.388234][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 59.406951][ T1063] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002] [ 59.418331][ T1063] System zones: 0-2, 18-18 [ 59.419293][ T28] audit: type=1400 audit(109.730:343): avc: denied { setopt } for pid=1066 comm="syz.1.292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 59.443198][ T1063] , 34-34 [ 59.453865][ T28] audit: type=1400 audit(109.760:344): avc: denied { write } for pid=1066 comm="syz.1.292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 59.505912][ T1063] EXT4-fs error (device loop3): ext4_orphan_get:1431: comm syz.3.287: bad orphan inode 15 [ 59.517164][ T1063] ext4_test_bit(bit=14, block=18) = 1 [ 59.522735][ T1063] is_bad_inode(inode)=0 [ 59.527127][ T1063] NEXT_ORPHAN(inode)=2264924160 [ 59.532073][ T1063] max_ino=32 [ 59.535463][ T1063] i_nlink=0 [ 59.548387][ T1063] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #15: comm syz.3.287: corrupted inode contents [ 59.561144][ T1063] EXT4-fs error (device loop3): ext4_dirty_inode:6158: inode #15: comm syz.3.287: mark_inode_dirty error [ 59.584043][ T1063] EXT4-fs error (device loop3): ext4_do_update_inode:5281: inode #15: comm syz.3.287: corrupted inode contents [ 59.646374][ T1063] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2947: inode #15: comm syz.3.287: mark_inode_dirty error [ 59.735728][ T1063] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2950: inode #15: comm syz.3.287: mark inode dirty (error -117) [ 59.804573][ T1063] EXT4-fs warning (device loop3): ext4_evict_inode:301: xattr delete (err -117) [ 59.808382][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 59.822450][ T1063] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 59.827782][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 59.843711][ T1063] EXT4-fs error (device loop3): ext4_search_dir:1549: inode #2: block 3: comm syz.3.287: bad entry in directory: rec_len is smaller than minimal - offset=44, inode=262156, rec_len=0, size=4096 fake=0 [ 59.869980][ T287] EXT4-fs (loop3): unmounting filesystem. [ 59.877865][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 60.645715][ T1090] netlink: 8 bytes leftover after parsing attributes in process `syz.2.298'. [ 61.015535][ T1101] loop2: detected capacity change from 0 to 512 [ 61.057455][ T1101] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 61.073841][ T1101] FAT-fs (loop2): Filesystem has been set read-only [ 61.934810][ T1109] loop1: detected capacity change from 0 to 512 [ 62.017494][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 62.029392][ T28] audit: type=1400 audit(112.340:345): avc: denied { mmap_zero } for pid=1115 comm="syz.3.309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 62.041953][ T1116] loop2: detected capacity change from 0 to 512 [ 62.055517][ T1116] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 62.064710][ T1109] EXT4-fs warning (device loop1): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 62.066766][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 62.079814][ T1109] EXT4-fs warning (device loop1): dx_probe:881: Enable large directory feature to access it [ 62.112785][ T1109] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.303: Corrupt directory, running e2fsck is recommended [ 62.223418][ T1109] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -117 [ 62.418320][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 62.436579][ T1109] EXT4-fs error (device loop1): ext4_iget_extra_inode:4765: inode #15: comm syz.1.303: corrupted in-inode xattr [ 62.449702][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 62.462954][ T1109] EXT4-fs error (device loop1): ext4_orphan_get:1410: comm syz.1.303: couldn't read orphan inode 15 (err -117) [ 62.480919][ T1127] loop2: detected capacity change from 0 to 512 [ 62.484305][ T1109] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 62.499843][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 62.526431][ T1109] EXT4-fs (loop1): re-mounted. Quota mode: writeback. [ 62.540520][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 62.555294][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 62.567252][ T288] EXT4-fs (loop1): unmounting filesystem. [ 62.576009][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 62.589723][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 63.685665][ T1148] loop2: detected capacity change from 0 to 2048 [ 63.693926][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 64.022341][ T1148] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 64.040443][ T290] EXT4-fs (loop2): unmounting filesystem. [ 65.078923][ T1160] loop3: detected capacity change from 0 to 512 [ 65.086098][ T1162] IPv6: NLM_F_CREATE should be specified when creating new route [ 65.119408][ T1160] EXT4-fs warning (device loop3): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 65.132700][ T1160] EXT4-fs warning (device loop3): dx_probe:881: Enable large directory feature to access it [ 65.142901][ T1160] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.324: Corrupt directory, running e2fsck is recommended [ 65.146523][ T1168] netlink: 104 bytes leftover after parsing attributes in process `syz.4.326'. [ 65.159954][ T28] audit: type=1400 audit(115.460:346): avc: denied { nlmsg_read } for pid=1167 comm="syz.4.326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 65.184784][ T1160] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -117 [ 65.193218][ T1160] EXT4-fs error (device loop3): ext4_iget_extra_inode:4765: inode #15: comm syz.3.324: corrupted in-inode xattr [ 65.215282][ T1172] loop2: detected capacity change from 0 to 512 [ 65.235384][ T1172] EXT4-fs: Ignoring removed mblk_io_submit option [ 65.262931][ T1160] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.324: couldn't read orphan inode 15 (err -117) [ 65.276101][ T1172] EXT4-fs error (device loop2): ext4_iget_extra_inode:4765: inode #15: comm syz.2.328: corrupted in-inode xattr [ 65.296975][ T1172] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.328: couldn't read orphan inode 15 (err -117) [ 65.309265][ T1160] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 65.332119][ T1172] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 65.341801][ T1160] EXT4-fs (loop3): re-mounted. Quota mode: writeback. [ 66.059052][ T290] EXT4-fs (loop2): unmounting filesystem. [ 66.089216][ T1183] loop2: detected capacity change from 0 to 4096 [ 66.104287][ T1183] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 66.143293][ T287] EXT4-fs (loop3): unmounting filesystem. [ 66.153546][ T290] EXT4-fs (loop2): unmounting filesystem. [ 66.180183][ T28] audit: type=1400 audit(116.490:347): avc: denied { setopt } for pid=1186 comm="syz.3.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 67.373278][ T1198] loop1: detected capacity change from 0 to 1024 [ 67.381137][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 67.391460][ T28] audit: type=1400 audit(117.700:348): avc: denied { getopt } for pid=1199 comm="syz.2.338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 67.406463][ T1198] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 67.443661][ T1198] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 67.454712][ T1207] loop2: detected capacity change from 0 to 512 [ 67.463014][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 67.473034][ T1198] EXT4-fs (loop1): invalid journal inode [ 67.478941][ T1198] EXT4-fs (loop1): can't get journal size [ 67.484979][ T1207] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 67.496939][ T1198] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 67.507110][ T1207] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.341: invalid indirect mapped block 1023410176 (level 0) [ 67.524121][ T1207] EXT4-fs (loop2): Remounting filesystem read-only [ 67.531114][ T1207] EXT4-fs error (device loop2): mb_free_blocks:1839: group 0, inode 11: block 237:freeing already freed block (bit 236); block bitmap corrupt. [ 67.546416][ T1207] EXT4-fs (loop2): Remounting filesystem read-only [ 67.553217][ T1207] EXT4-fs (loop2): 1 truncate cleaned up [ 67.558902][ T1207] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 67.570136][ T1207] EXT4-fs (loop2): re-mounted. Quota mode: none. [ 67.739406][ T1213] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 37: comm syz.1.334: path /73/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 67.761007][ T1213] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 3: comm syz.1.334: path /73/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=511, rec_len=65535, size=1024 fake=0 [ 67.794755][ T290] EXT4-fs (loop2): unmounting filesystem. [ 67.837473][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 67.901819][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 68.203962][ T288] EXT4-fs (loop1): unmounting filesystem. [ 68.211936][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 68.221867][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 69.315407][ T1222] loop4: detected capacity change from 0 to 512 [ 69.323267][ T360] udevd[360]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 70.547086][ T1238] process 'syz.1.348' launched './file1' with NULL argv: empty string added [ 70.563959][ T1222] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 70.592702][ T1222] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 70.622684][ T1222] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.346: Corrupt directory, running e2fsck is recommended [ 70.638286][ T1222] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 70.646902][ T1222] EXT4-fs error (device loop4): ext4_iget_extra_inode:4765: inode #15: comm syz.4.346: corrupted in-inode xattr [ 70.659270][ T1222] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.346: couldn't read orphan inode 15 (err -117) [ 70.671490][ T1222] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 70.686610][ T1222] EXT4-fs (loop4): re-mounted. Quota mode: writeback. [ 70.701273][ T291] EXT4-fs (loop4): unmounting filesystem. [ 70.727497][ T360] udevd[360]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 70.741515][ T360] udevd[360]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 71.952508][ T1249] loop3: detected capacity change from 0 to 512 [ 71.963789][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 71.972819][ T1248] hub 6-0:1.0: USB hub found [ 71.978611][ T1249] EXT4-fs error (device loop3): ext4_orphan_get:1405: inode #15: comm syz.3.352: iget: bad i_size value: 38620345925642 [ 71.991312][ T1248] hub 6-0:1.0: 1 port detected [ 71.996510][ T1249] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.352: couldn't read orphan inode 15 (err -117) [ 72.008599][ T1249] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 72.018470][ T1247] FAULT_INJECTION: forcing a failure. [ 72.018470][ T1247] name failslab, interval 1, probability 0, space 0, times 0 [ 72.039312][ T287] EXT4-fs (loop3): unmounting filesystem. [ 72.050824][ T1247] CPU: 0 PID: 1247 Comm: syz.4.353 Not tainted syzkaller #0 [ 72.058177][ T1247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 72.068361][ T1247] Call Trace: [ 72.071663][ T1247] [ 72.074629][ T1247] __dump_stack+0x21/0x24 [ 72.079027][ T1247] dump_stack_lvl+0x110/0x170 [ 72.083743][ T1247] ? __cfi_dump_stack_lvl+0x8/0x8 [ 72.088897][ T1247] dump_stack+0x15/0x24 [ 72.093105][ T1247] should_fail_ex+0x3bf/0x510 [ 72.097817][ T1247] __should_failslab+0xac/0xf0 [ 72.102659][ T1247] should_failslab+0x9/0x20 [ 72.107192][ T1247] kmem_cache_alloc_node+0x42/0x330 [ 72.112429][ T1247] ? __alloc_skb+0xe8/0x4a0 [ 72.116996][ T1247] ? tipc_msg_build+0xce/0xf60 [ 72.121789][ T1247] ? tipc_send_group_bcast+0x766/0xa90 [ 72.127289][ T1247] __alloc_skb+0xe8/0x4a0 [ 72.131669][ T1247] __pskb_copy_fclone+0xa7/0xf60 [ 72.136659][ T1247] tipc_msg_reassemble+0x12e/0x440 [ 72.141892][ T1247] tipc_mcast_xmit+0x1e8/0x1790 [ 72.146781][ T1247] ? __cfi_tipc_mcast_xmit+0x10/0x10 [ 72.152104][ T1247] ? __kasan_check_write+0x14/0x20 [ 72.157274][ T1247] ? tipc_msg_build+0x3bf/0xf60 [ 72.162169][ T1247] ? __check_object_size+0x90/0x600 [ 72.167396][ T1247] ? memcpy+0x56/0x70 [ 72.171413][ T1247] ? tipc_msg_build+0x440/0xf60 [ 72.176347][ T1247] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 72.182283][ T1247] ? __release_sock+0x154/0x380 [ 72.187167][ T1247] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 72.193108][ T1247] ? tipc_group_bc_cong+0x160/0x210 [ 72.198348][ T1247] tipc_send_group_bcast+0x79e/0xa90 [ 72.203690][ T1247] ? tipc_wait_for_connect+0x5d0/0x5d0 [ 72.209192][ T1247] ? __cfi_woken_wake_function+0x10/0x10 [ 72.214859][ T1247] ? __kasan_slab_free+0x11/0x20 [ 72.219838][ T1247] ? slab_free_freelist_hook+0xc2/0x190 [ 72.225406][ T1247] __tipc_sendmsg+0x336/0x2860 [ 72.230196][ T1247] ? rht_lock+0x120/0x120 [ 72.234586][ T1247] ? reweight_entity+0x73/0x5c0 [ 72.239482][ T1247] ? avc_has_perm+0x163/0x250 [ 72.244173][ T1247] ? __cfi_avc_has_perm+0x10/0x10 [ 72.249211][ T1247] ? __kasan_check_write+0x14/0x20 [ 72.254338][ T1247] ? _raw_spin_lock_bh+0x94/0xf0 [ 72.259321][ T1247] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 72.264811][ T1247] ? __local_bh_enable_ip+0x58/0x80 [ 72.270022][ T1247] ? lock_sock_nested+0x212/0x290 [ 72.275060][ T1247] ? __cfi_lock_sock_nested+0x10/0x10 [ 72.280446][ T1247] ? finish_task_switch+0x16b/0x7c0 [ 72.285668][ T1247] ? switch_mm_irqs_off+0x2fb/0x960 [ 72.290882][ T1247] tipc_sendmsg+0x55/0x70 [ 72.295223][ T1247] ? __cfi_tipc_sendmsg+0x10/0x10 [ 72.300256][ T1247] ____sys_sendmsg+0x5fb/0x9c0 [ 72.305044][ T1247] ? __sys_sendmsg_sock+0x40/0x40 [ 72.310109][ T1247] ? import_iovec+0x7c/0xb0 [ 72.314634][ T1247] ___sys_sendmsg+0x2a2/0x360 [ 72.319341][ T1247] ? __sys_sendmsg+0x290/0x290 [ 72.324131][ T1247] ? __fdget+0x19c/0x220 [ 72.328394][ T1247] __x64_sys_sendmsg+0x20d/0x2e0 [ 72.333378][ T1247] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 72.338868][ T1247] ? __kasan_check_write+0x14/0x20 [ 72.343996][ T1247] ? fpregs_restore_userregs+0x128/0x260 [ 72.349655][ T1247] ? switch_fpu_return+0xe/0x10 [ 72.354523][ T1247] x64_sys_call+0x171/0x9a0 [ 72.359042][ T1247] do_syscall_64+0x4c/0xa0 [ 72.363484][ T1247] ? clear_bhb_loop+0x30/0x80 [ 72.368174][ T1247] ? clear_bhb_loop+0x30/0x80 [ 72.372865][ T1247] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 72.378783][ T1247] RIP: 0033:0x7f218819e559 [ 72.383228][ T1247] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.402856][ T1247] RSP: 002b:00007f2189003028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 72.411318][ T1247] RAX: ffffffffffffffda RBX: 00007f2188425fa0 RCX: 00007f218819e559 [ 72.419336][ T1247] RDX: 0000000000000010 RSI: 0000200000000640 RDI: 0000000000000006 [ 72.427423][ T1247] RBP: 00007f21882358b0 R08: 0000000000000000 R09: 0000000000000000 [ 72.435440][ T1247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.443429][ T1247] R13: 00007f2188426038 R14: 00007f2188425fa0 R15: 00007ffe461ebbf8 [ 72.451423][ T1247] [ 72.469656][ T1258] loop2: detected capacity change from 0 to 512 [ 72.492034][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 72.511144][ T1258] EXT4-fs error (device loop2): __ext4_iget:5104: inode #11: block 1: comm syz.2.357: invalid block [ 72.530461][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 72.549978][ T360] udevd[360]: inotify_add_watch(7, /dev/loop3, 10) failed: Not a directory [ 72.559141][ T1258] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.357: couldn't read orphan inode 11 (err -117) [ 72.588427][ T1258] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 72.611142][ T28] audit: type=1326 audit(122.920:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.613584][ T290] EXT4-fs (loop2): unmounting filesystem. [ 72.635238][ T28] audit: type=1326 audit(122.920:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.665256][ T28] audit: type=1326 audit(122.950:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.689310][ T28] audit: type=1326 audit(122.950:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.718754][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 72.728094][ T28] audit: type=1326 audit(122.950:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.753819][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 72.763388][ T28] audit: type=1326 audit(122.950:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.792688][ T28] audit: type=1326 audit(122.950:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.817059][ T28] audit: type=1326 audit(122.960:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 72.841197][ T28] audit: type=1326 audit(122.960:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1255 comm="syz.1.356" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f207639e559 code=0x7ffc0000 [ 74.226174][ T28] audit: type=1400 audit(124.540:358): avc: denied { create } for pid=1267 comm="syz.1.358" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 75.334331][ T1302] loop1: detected capacity change from 0 to 512 [ 75.419888][ T1302] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 75.477601][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 75.639640][ T1302] EXT4-fs (loop1): re-mounted. Quota mode: writeback. [ 75.667073][ T288] EXT4-fs (loop1): unmounting filesystem. [ 75.686643][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 75.706281][ T1326] loop2: detected capacity change from 0 to 512 [ 75.714106][ T360] udevd[360]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 75.714201][ T312] udevd[312]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 75.738753][ T1326] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.383: bg 0: block 288: padding at end of block bitmap is not set [ 75.755478][ T1326] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 75.764661][ T1326] EXT4-fs error (device loop2): ext4_clear_blocks:883: inode #13: comm syz.2.383: attempt to clear invalid blocks 1024 len 1 [ 75.778449][ T1326] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.383: invalid indirect mapped block 1819239214 (level 0) [ 75.792803][ T1326] EXT4-fs (loop2): 1 truncate cleaned up [ 75.798515][ T1326] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 75.821300][ T290] EXT4-fs (loop2): unmounting filesystem. [ 75.830350][ T360] udevd[360]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 77.362855][ T1336] device syzkaller0 entered promiscuous mode [ 79.531464][ T1358] loop2: detected capacity change from 0 to 4096 [ 79.544903][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 79.544919][ T28] audit: type=1400 audit(129.860:362): avc: denied { create } for pid=1365 comm="syz.1.397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 79.554499][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 79.605196][ T1358] EXT4-fs warning (device sda1): verify_group_input:172: Reserved blocks too high (12) [ 79.619938][ T1370] device syzkaller0 entered promiscuous mode [ 79.628375][ T28] audit: type=1400 audit(129.900:363): avc: denied { ioctl } for pid=1365 comm="syz.1.397" path="socket:[19427]" dev="sockfs" ino=19427 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 79.637137][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 79.665225][ T28] audit: type=1400 audit(129.900:364): avc: denied { write } for pid=1365 comm="syz.1.397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 79.694825][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop2, 10) failed: Not a directory [ 79.826392][ T1372] netlink: 48 bytes leftover after parsing attributes in process `syz.1.399'. [ 79.876229][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop7, 10) failed: Not a directory [ 81.496250][ T1381] loop4: detected capacity change from 0 to 512 [ 81.505486][ T28] audit: type=1400 audit(131.820:365): avc: denied { search } for pid=1383 comm="syz.2.401" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 81.516420][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 81.564879][ T1381] EXT4-fs (loop4): 1 orphan inode deleted [ 81.570681][ T1381] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 81.582789][ T10] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 81.602791][ T10] EXT4-fs error (device loop4): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 81.639880][ T1396] loop1: detected capacity change from 0 to 2048 [ 81.694665][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 81.712557][ T28] audit: type=1400 audit(132.020:366): avc: denied { mounton } for pid=1380 comm="syz.4.403" path="/75/file1/tracing" dev="loop4" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 81.786715][ T28] audit: type=1400 audit(132.030:367): avc: denied { map } for pid=1380 comm="syz.4.403" path="/75/file1/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=13693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 81.866713][ T1396] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 82.590772][ T291] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 4: comm syz-executor: path /75/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.613617][ T288] EXT4-fs (loop1): unmounting filesystem. [ 82.652585][ T28] audit: type=1400 audit(132.960:368): avc: denied { rmdir } for pid=291 comm="syz-executor" name="lost+found" dev="loop4" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 82.675178][ T291] EXT4-fs error (device loop4): ext4_empty_dir:3145: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.708289][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.716529][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 82.732797][ T291] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 4: comm syz-executor: path /75/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.754106][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop1, 10) failed: Not a directory [ 82.763786][ T291] EXT4-fs error (device loop4): ext4_empty_dir:3145: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.764901][ T1409] netlink: 112 bytes leftover after parsing attributes in process `syz.1.410'. [ 82.792056][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.804787][ T291] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 4: comm syz-executor: path /75/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.826099][ T291] EXT4-fs error (device loop4): ext4_empty_dir:3145: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.845068][ T1409] netlink: 12 bytes leftover after parsing attributes in process `syz.1.410'. [ 82.848207][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.854986][ T1409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.410'. [ 82.865844][ T291] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 4: comm syz-executor: path /75/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.875424][ T1409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.410'. [ 82.895826][ T291] EXT4-fs error (device loop4): ext4_empty_dir:3145: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.923956][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.935539][ T291] EXT4-fs error (device loop4): ext4_readdir:263: inode #11: block 4: comm syz-executor: path /75/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1 [ 82.956672][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.968760][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.980878][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 82.993160][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 83.005207][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 83.017232][ T291] EXT4-fs warning (device loop4): ext4_empty_dir:3147: inode #11: comm syz-executor: directory missing '.' [ 83.115154][ T291] EXT4-fs (loop4): unmounting filesystem. [ 83.123334][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 83.133489][ T1366] udevd[1366]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 83.188509][ T1415] loop1: detected capacity change from 0 to 128 [ 83.205012][ T1415] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 83.222940][ T288] EXT4-fs (loop1): unmounting filesystem. [ 83.276398][ T1418] device syzkaller0 entered promiscuous mode [ 83.435577][ T353] tipc: Left network mode [ 83.659244][ T28] audit: type=1400 audit(133.970:369): avc: denied { write } for pid=1437 comm="syz.1.421" name="urandom" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 84.215075][ T353] device bridge_slave_1 left promiscuous mode [ 84.221541][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.231188][ T353] device bridge_slave_0 left promiscuous mode [ 84.237747][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.249246][ T353] device veth1_macvtap left promiscuous mode [ 84.255579][ T353] device veth0_vlan left promiscuous mode [ 86.008452][ T1455] loop1: detected capacity change from 0 to 256 [ 86.028191][ T1455] FAT-fs (loop1): Directory bread(block 64) failed [ 86.054405][ T1455] FAT-fs (loop1): Directory bread(block 65) failed [ 86.061026][ T1455] FAT-fs (loop1): Directory bread(block 66) failed [ 86.078051][ T1455] FAT-fs (loop1): Directory bread(block 67) failed [ 86.089575][ T1459] loop2: detected capacity change from 0 to 1024 [ 86.102830][ T1455] FAT-fs (loop1): Directory bread(block 68) failed [ 86.121431][ T1459] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 86.132643][ T1455] FAT-fs (loop1): Directory bread(block 69) failed [ 86.139233][ T1455] FAT-fs (loop1): Directory bread(block 70) failed [ 86.154040][ T1457] FAULT_INJECTION: forcing a failure. [ 86.154040][ T1457] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 86.162843][ T1455] FAT-fs (loop1): Directory bread(block 71) failed [ 86.173951][ T1459] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 86.187641][ T1457] CPU: 0 PID: 1457 Comm: syz.3.427 Not tainted syzkaller #0 [ 86.194229][ T1455] FAT-fs (loop1): Directory bread(block 72) failed [ 86.194973][ T1457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 86.194989][ T1457] Call Trace: [ 86.201496][ T1455] FAT-fs (loop1): Directory bread(block 73) failed [ 86.211558][ T1457] [ 86.211569][ T1457] __dump_stack+0x21/0x24 [ 86.211609][ T1457] dump_stack_lvl+0x110/0x170 [ 86.226426][ T1459] EXT4-fs (loop2): invalid journal inode [ 86.228692][ T1457] ? __cfi_dump_stack_lvl+0x8/0x8 [ 86.242782][ T1459] EXT4-fs (loop2): can't get journal size [ 86.244077][ T1457] ? rdmsr_safe_on_cpu+0x157/0x260 [ 86.254908][ T1457] ? __cfi_rdmsr_safe_on_cpu+0x10/0x10 [ 86.260399][ T1457] dump_stack+0x15/0x24 [ 86.264609][ T1457] should_fail_ex+0x3bf/0x510 [ 86.269323][ T1457] should_fail+0xb/0x10 [ 86.273510][ T1457] should_fail_usercopy+0x1a/0x20 [ 86.278568][ T1457] _copy_to_user+0x1e/0x90 [ 86.283043][ T1457] msr_read+0x122/0x1b0 [ 86.287241][ T1457] ? __cfi_msr_read+0x10/0x10 [ 86.291982][ T1457] ? security_file_permission+0x94/0xb0 [ 86.297580][ T1457] ? __cfi_msr_read+0x10/0x10 [ 86.302299][ T1457] vfs_read+0x286/0x930 [ 86.306493][ T1457] ? __cfi_vfs_read+0x10/0x10 [ 86.311202][ T1457] ? __fget_files+0x2d1/0x330 [ 86.315918][ T1457] ? __fdget_pos+0x1f2/0x380 [ 86.320547][ T1457] ? ksys_read+0x70/0x260 [ 86.324910][ T1457] ksys_read+0x14a/0x260 [ 86.329184][ T1457] ? __cfi_ksys_read+0x10/0x10 [ 86.333984][ T1457] ? fpregs_restore_userregs+0x128/0x260 [ 86.339658][ T1457] __x64_sys_read+0x7b/0x90 [ 86.344228][ T1457] x64_sys_call+0x2f/0x9a0 [ 86.348683][ T1457] do_syscall_64+0x4c/0xa0 [ 86.353141][ T1457] ? clear_bhb_loop+0x30/0x80 [ 86.357860][ T1457] ? clear_bhb_loop+0x30/0x80 [ 86.362573][ T1457] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.368501][ T1457] RIP: 0033:0x7f7ade19e559 [ 86.372946][ T1457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.392582][ T1457] RSP: 002b:00007f7adf03b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 86.401052][ T1457] RAX: ffffffffffffffda RBX: 00007f7ade425fa0 RCX: 00007f7ade19e559 [ 86.409059][ T1457] RDX: 0000000000018ff8 RSI: 00002000000011c0 RDI: 0000000000000004 [ 86.417066][ T1457] RBP: 00007f7ade2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 86.425070][ T1457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.433122][ T1457] R13: 00007f7ade426038 R14: 00007f7ade425fa0 R15: 00007ffea2ad4838 [ 86.441162][ T1457] [ 86.445992][ T1459] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 86.485618][ T1459] ptp ptp0: new virtual clock ptp1 [ 86.490796][ T1459] ptp ptp0: guarantee physical clock free running SYZFAIL: mount(dev) failed (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=6 req=221 state=3 status=67 (errno 32: Broken pipe) [ 86.578642][ T28] audit: type=1400 audit(136.890:370): avc: denied { write } for pid=279 comm="syz-executor" path="pipe:[14075]" dev="pipefs" ino=14075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 86.601735][ T1469] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 37: comm syz.2.428: path /103/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 86.623460][ T1469] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 3: comm syz.2.428: path /103/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=511, rec_len=65535, size=1024 fake=0 [ 86.796250][ T1469] EXT4-fs (loop2): unmounting filesystem. [ 87.623778][ T8] device bridge_slave_1 left promiscuous mode [ 87.630015][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.637860][ T8] device bridge_slave_0 left promiscuous mode [ 87.644097][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.652570][ T8] device bridge_slave_1 left promiscuous mode [ 87.658895][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.666511][ T8] device bridge_slave_0 left promiscuous mode [ 87.672915][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.681053][ T8] device bridge_slave_1 left promiscuous mode [ 87.687359][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.694938][ T8] device bridge_slave_0 left promiscuous mode [ 87.701057][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.709584][ T8] device veth1_macvtap left promiscuous mode [ 87.715690][ T8] device veth0_vlan left promiscuous mode [ 87.721857][ T8] device veth1_macvtap left promiscuous mode [ 87.727998][ T8] device veth0_vlan left promiscuous mode [ 87.734195][ T8] device veth1_macvtap left promiscuous mode [ 87.740211][ T8] device veth0_vlan left promiscuous mode